possible DNS-rebind attack detected: dc.rm.skyq.info

[gipjon]

last 18 months no issues at all with the router 

I started having issues , 3 times so far in 6 weeks

I think the router software crashes or the router is locking up 

The router stays connected to the internet

All devices are reporting connected to the router but only some will have internet, Other devices say connected to the router but no internet. you can swap from wired to wifi and still have the same issue, it's like the mac address is blocked.  

The other thing is, you can't log into the router even on a device that's not affected. The website address times out. 

the only cure is to unplug the Vodafone router from the mains and plug it back in then it's fine again. 

. The other night the router dropped 3 times around 2.30 am which is probably not related but a little odd as the router has never done that before. the only thing I notice is in the logs it keeps saying " possible DNS-rebind attack detected: dc.rm.skyq.info" 

On the sky forum, there is some reference about: dc.rm.skyq.info being blocked by a firewalls which then is blocking the sky paramount plus app 

anyone any ideas 

[Cynric]

.@gipjon Must be tin-foil hat time. They (whoever "they" are) have seen this thread and stopped their bot. 😂

It must be getting to me! Otherwise I would suggest that VF have fixed a duff configuration, Just out of curiosity, did you get a router update at midnight?

[gipjon]

update 

It was the router that was doing the rebind tests according to the router log 

I was using google DNS and was getting flooded with these DNS rebind attacks 1000 per day etc

The strange thing is I swapped to 1111 and 9999 and now I have only had 6 DNS rebind attacks  in ten days 

now I don't know if this is just a coincidence by swapping the DNS away from google OR if it was something to do with Vodafone and the router. 

It will be interesting now if my router still locks up, stopping you from logging in to the router menu and some devices not having internet, 

router uptime 39days 

Firmware version

19.4.0551-3261103-20211126144629-7efccd9e333e995b72430e4ef45c0f27f265fb5d

[Cynric]

.@gipjon I am just thinking aloud; have you:

blacklisted any *.google.com sub-domains,

got any Google devices which may over-ride or ignore your DNS settings?

because I am wondering if some process was doing a "heartbeat" and constantly retrying as it didn''t get all of its transactions completed.

[gipjon]

Nothing blacklist 

and I did wonder the same 

Well, the firmware has not locked the router yet 

Still don't fully understand this, to be honest

[gipjon]

update 

still not getting the possible DNS-rebind attack after changing DNS from google to 1.1.1.1

But the router started crashing out again this seems to happen every 6 weeks or so. I had to reboot it this morning at 5 am due to around half of the devices connected stopping working. , 2 days ago sky box and mini box stopped working,1 day ago Xbox stopped working and a moto phone stopped working, This morning my laptop is working but can't log into the router but my phone can log into the router 

what I did notice on 1 of the Xbox it says connected but 

ipv4 connection says 

IP address .0.0.0.0

subnet 0.0.0.0

gateway 192.168.1.1

latency 174

download 0

upload 0

packet loss 0%

i don't think the router crashing and the rebind attract is connected so going to make a new thread for the router crashing out as a few user seem to have the same issue which started 5 months ago 

[Cynric]

This https://forum.vodafone.co.uk/t5/Broadband-connection/router-crashing-which-started-about-4-6-months-... is the link to the new thread about the router crashing that .@gipjon has created.