Page 1 of 1

DNS-Rebind Attack

Posted: Thu Mar 25, 2021 6:12 am
by cobra98
I have sometimes problems with alexa and was wondering if the

dnsmasq[2577]: possible dns-rebind attack detected: googleads.g.doubleclick.net
dnsmasq[2577]: possible dns-rebind attack detected: dpm.demdex.net
dnsmasq[2577]: possible dns-rebind attack detected: googleads.g.doubleclick.net
dnsmasq[2577]: possible dns-rebind attack detected: 5r0bz16iyqx8m88z.myfritz.net

Could be causing the problem?
Fritzbox i have for wifi and gargoyle is seperate for LAN
Should i exclude something and how/where?

Re: DNS-Rebind Attack

Posted: Thu Mar 25, 2021 12:35 pm
by RomanHK
It also made me "Alcatel" phone with android 5, I exchanged it for Xiaomi Redmi with android 10 and since then I have peace of mind.

According to my analysis, it was targeted ads that tried to access from IP 192.168.1.1, 10.0.0.1, etc.

:idea: First, try updating the firmware. I don't know anything better.

Re: DNS-Rebind Attack

Posted: Thu Apr 01, 2021 7:53 pm
by cobra98
Firmware of mobile or gargoyle you mean?
I am running on stable, not sure if i should upgrade to latest as i don`t want to set up all again.

Re: DNS-Rebind Attack

Posted: Fri Apr 02, 2021 3:10 am
by RomanHK
Try changing the IP address of the DNS server, maybe it will improve (for example 1.1.1.1 or 8.8.8.8).

Your ISP may have a broken DNS server, and then these domains could be incorrectly answered and resolved.

Of course, if you need, this protection can be turned off.
The explanation is here: https://forum.openwrt.org/t/possible-dn ... tack/21740