So I am testing RouterOS7 Beta 3 and with debug turned on, I am seeing dns lookups for strtbiz.site.
What is this connection being used for?
I searched the forums and nothing came up for that domain.
Adding detail:
11:46:10 echo: dns local query: #417 strtbiz.site. A
11:46:10 echo: dns,packet — sending udp query to 192.168.1.35:53:
11:46:10 echo: dns,packet id:3705 rd:1 tc:0 aa:0 qr:0 ra:0 QUERY ‘no error’
11:46:10 echo: dns,packet question: strtbiz.site.
IN
11:46:10 echo: dns,packet — got answer from 192.168.1.35:53:
11:46:10 echo: dns,packet id:3705 rd:1 tc:0 aa:0 qr:1 ra:1 QUERY ‘no error’
11:46:10 echo: dns,packet question: strtbiz.site.IN
11:46:10 echo: dns,packet answer:
11:46:10 echo: dns,packet strtbiz.site.:A:300=172.67.196.9
11:46:10 echo: dns,packet strtbiz.site.:A:300=104.21.92.164
11:46:10 echo: dns done query: #417 strtbiz.site 172.67.196.9
If you ask your favourite search engine, you’ll find out that it looks like something you don’t want to have. It seems to be related to some botnet. Check if you have some unwanted scheduled scripts on your device.
Thanks for the reply.
Looked in files from WinBox and under system/scripts and nothing found.
Doing a packet sniffer, I am not seeing anything going out to either IP listed.
Any place else I should be looking?
I’d try System->Scheduler.
Best is to export all router configuration to a file and inspect it.
Must lilkely you’ve set “allow remote requests” in the DNS Settings and you didn’t block access to it from the internet, and now your Router is part of a DNS Attack.
Secure your router.