DNS query

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › DNS query

endmaxd

1 post

Wannabe Geek

#179068 25-Aug-2015 12:33

Hey Guys,

I found recently that I was having issues with browsing to some site and latency when using streaming services like Sky Go. During my troubleshooting I found that my Netcomm, supplied by Orcon, had static DNS servers set. Primary was 103.43.75.60 with 8.8.8.8, Google, as the secondary. I was under the impression that Orcon's DNS servers were 121.98.0.1 and 121.98.0.2. I found changing them back to automatic fixed the issues I was having but am a little bit wary of how they were changed as I have factory reset my modem previously.

Just wondering if anyone else has had these same or similar DNS servers appear in their modems.

Nick

Nebbie

458 posts

Ultimate Geek

Trusted

#1374041 25-Aug-2015 17:12

I think your router firewall is off and your default password is still present or was cracked.
There are a large number of routers out there that have a UPNP bug that you can cause the firewall to turn off exposing it to the internet surprising most people never change the default password.

That IP is a US based IP and running a name sever open to the world and your requests will have been monitored or intercepted.

Change ALL passwords :) Edit: <<< ok might be extreme but always a good to do.

---------------------------------------------------------------
Nebukadnessar

DravidDavid

1907 posts

Uber Geek

#1376941 31-Aug-2015 10:46

That's quite funny.

I've recently been experiencing time-outs on Google. I have a Draytek 2912 router on a fibre connection.

I observed the DNS settings as being:

Primary: 103.43.75.60
Secondary: 8.8.8.8

I think mine has been compromised too. I found this thread via a Google search. I've been getting redirected on my smartphone but none of the workstations appear to be effected at all. AdBlock and software firewalls could be a factor there. I'll have to call to find out what the proper DNS settings are.

EDIT: Confirmed router has been compromised. It's a known issue apparently. The solution is to change the password away from the default and reset your DNS settings.