Ongoing DNS Issues? Timeouts....

[#1]

Quote from: gborland

OK, after reading other threads, my woes may also be due to DNS hijacking (I have an Edimax router).

Hi,
I'd this this is correct. Running a DNS lookup against the server you say you had set in your router I get this result...

C:\Users\mturner>nslookup google.com 50.63.128.135
Server:  ip-50-63-128-135.ip.secureserver.net
Address:  50.63.128.135
Name:    google.com
Address:  50.31.152.253

Which sends me to this website... Uh oh!

Make sure you get your router's DNS server set correctly to Plusnet's DNS server (it will be configured when it connects to the internet automatically unless it's overridden somewhere in the settings)
This is the correct DNS response that you should see.

C:\Users\mturner>nslookup google.com 212.159.6.9
Server:  cdns01.plus.net
Address:  212.159.6.9
Non-authoritative answer:
Name:    google.com
Addresses:  2a00:1450:4009:805::1008
          173.194.41.162
          173.194.41.164
          173.194.41.174
          173.194.41.169
          173.194.41.161
          173.194.41.160
          173.194.41.167
          173.194.41.163
          173.194.41.165
          173.194.41.166
          173.194.41.168

[#2]

Matt - his problems go far deeper than just setting the correct DNS servers!

[#3]

I think there should be some kind of sticky about this - because it must be affecting quite a few people.
One problem is the router manufacturers seem to no longer introduce firmware fixes on older routers for serious security flaws. The TP-Link/Edimax routers mentioned here have not have new firmwares for 5-6 years!!!!!

[#4]

Results from my o2 mobile.
Looks pretty much the same as my plusnet Supplied Broadband!
I guess some geek will be along shortly to tell me it's because icmp is being ignored cus Level3 is busy though  
-- 4.2.2.1 ping statistics ---33 packets transmitted, 33 received, 0% packet loss, time 32039ms rtt min/avg/max/mdev = 69.214/120.804/555.908/89.343 4 ms
--- 4.2.2.6 ping statistics ---41 packets transmitted, 24 received, 41% packet loss, time 40083ms rtt min/avg/max/mdev = 402.771/556.371/1670.501/327.577 ms
--- 4.2.2.3 ping statistics ---33 packets transmitted, 33 received, 0% packet loss, time 32043ms rtt min/avg/max/mdev = 327.545/450.980/1573.089/281.301 ms
--- 4.2.2.4 ping statistics ---35 packets transmitted, 9 received, 74% packet loss, time 34055ms rtt min/avg/max/mdev = 389.679/460.384/838.928/134.603 64 ms
--- 4.2.2.3 ping statistics ---32 packets transmitted, 32 received, 0% packet loss, time 31041ms rtt min/avg/max/mdev = 69.794/226.792/2194.092/416.333 ms
--- 4.2.2.2 ping statistics ---45 packets transmitted, 17 received, 62% packet loss, time 44086ms rtt min/avg/max/mdev = 114.106/147.189/182.190/15.754 ms

[#5]

http://www.pcworld.com/article/2104380/attack-campaign-compromises-300000-home-routers-alters-dns-se...

[#6]

Quote from: AndyH

I think there should be some kind of sticky about this - because it must be affecting quite a few people.

Quite right. We'll write something up and get a little bit of support up for you all for any other customers that may be affected.

[#7]

Is there any way Plusnet can block those DNS servers (like 50.63.128.135)? They serve no purpose but to infect people with god knows what kind of malware/trojans etc...

[#8]

http://www.theregister.co.uk/2014/03/11/plusnet_customers_complain_about_third_party_routers_being_h...
Apparently no Plusnet supplied routers have this issue, yet I have a Plusnet supplied dlink router doing the exact thing, changing the DNS to the 50.63.128.135 every other day!

[#9]

Bud,
What Make and model is the router and any ideas what Firmware Version it has on it?

[#10]

Or is there any way Plusnet can log people using those affected DNS addresses and contact them if they believe they are infected?
I suppose one problem with this is there could be new malicious DNS addresses being used each day.

[#11]

Quote from: Chris

Bud, What Make and model is the router and any ideas what Firmware Version it has on it?

It's a d-link 2680 with firmware PN1.0 I have been searching for an updated firmware for it but can only find a generic 1.03.  This was one of the tr69 models from a couple years back I was supplied with.

[#12]

That router was a test/trial router, from quite a few years ago.
I'd be happy to supply you with one of our current routers which should resolve this issue for you.

[#13]

That would be great thanks, it's on the wishartstromness account (if it's an auto set up model).

[#14]

No worries, I've got that sent off for you.

[#15]

Something that will hopefully help -  link