WHat are these mystery assigned IP addresses?

[SteverinoLA]

What the heck are these assighned IP addresses? If I delete them, then they just come back. I have no devices on those IP addresses.

 

[dave14305]

Probably malware.

Manually DHCP List and Domain Name Showing Unremovable Items

I used WireGuard to connect two routers, RT-AX86U & GT-AX6600 running newest merlin firmware, and everything was working fine. However, over the past few days I noticed something strange: ．In both routers, the manual DHCP list and the domain name field started showing unusual entries that I...

www.snbforums.com

 

[bennor]

What router, what firmware?
Have you rebooted the router as a troubleshooting step after removing the three entries and applying the changes?

 

[SteverinoLA]

AX86U Pro router on latest available Asus firmware. I looked up the MACs and the first one is VMWare and the second two are Realtek. How would malware get into my router?

 

[dave14305]

AX86U Pro router on latest available Asus firmware. I looked up the MACs and the first one is VMWare and the second two are Realtek. How would malware get into my router?

Usually through AiCloud, but many other weaknesses likely exist. Those MAC addresses match the other poster in the thread I linked. Factory reset and don't enable anything extra that isn't important for a router.

 

[SteverinoLA]

Crap, something weird up. I removed those 3 and added my usual 2. Saved and then rebooted router but the 3 I deleted are back but not the 2 I added.

 

[SteverinoLA]

Usually through AiCloud, but many other weaknesses likely exist. Those MAC addresses match the other poster in the thread I linked. Factory reset and don't enable anything extra that isn't important for a router.

AH, sorry. I missed that link. Yep, that's me too.

 

[bennor]

Crap, something weird up. I removed those 3 and added my usual 2. Saved and then rebooted router but the 3 I deleted are back but not the 2 I added.

If you used AiCloud in the past you could have been hit by the recent malware that used a vulnerability in AiCloud to infect Asus routers. Big discussion on the malware here:

Malware damaging ASUS routers?

This malware damaging Asus routers has to be described in a sticky thread with a warning sign! Update: Asus is releasing patched firmware for multiple models. Check for firmware updates! The changelog for most firmware releases contains the following: 1. Strengthened input validation and data...

www.snbforums.com

Several users in later posts in that discussion were helping people fix their bricked/infected routers.

Basic last resort troubleshooting step is to perform a hard factory reset followed by a basic manual configuration. Do not import a previously saved router.cfg file after performing the hard factory reset. Do just enough configuration to reach the router's GUI page then flash the very latest firmware for the router. Followed by another hard factory reset and basic manual configuration. Disconnect any attached USB devices from the router prior to performing the hard factory reset and do not reconnect the USB devices until the router is confirmed working properly.