Rogers DNS servers - possible security issue?

[Double_K]

@CommunityHelps

I'm seeing a significant amount of unsolicited inbound traffic from Rogers' DNS servers, trying to establish a UDP connection on multiple ports on my internet connection from port 53 on the servers.

Note: this is not response traffic to an outbound query - this is unsolicited inbound targetting multiple IANA User Ports & Dynamic Ports.  My firewall is successfully blocking these "attacks".

This is from the past two hours:

Servers:

67.231.208.232:53
pub-cdns7-ym-eth1.rpub.net.rogers.com

209.148.131.39:53
pub-cdns4-mtnk-eth1.rpub.net.rogers.com

67.231.208.234:53
pub-cdns9-ym-eth1.rpub.net.rogers.com

67.231.208.235:53
pub-cdns10-ym-eth1.rpub.net.rogers.com

67.231.208.226:53
pub-cdns1-ym-eth1.rpub.net.rogers.com

209.148.131.42:53
pub-cdns7-mtnk-eth1.rpub.net.rogers.com

209.148.131.43:53
pub-cdns8-mtnk-eth1.rpub.net.rogers.com

209.148.131.38:53
pub-cdns3-mtnk-eth1.rpub.net.rogers.com

67.231.208.231:53
pub-cdns6-ym-eth1.rpub.net.rogers.com

67.231.208.233:53
pub-cdns8-ym-eth1.rpub.net.rogers.com

67.231.208.230:53
pub-cdns5-ym-eth1.rpub.net.rogers.com

209.148.131.44:53
pub-cdns9-mtnk-eth1.rpub.net.rogers.com

209.148.131.45:53
pub-cdns10-mtnk-eth1.rpub.net.rogers.com

209.148.131.41:53
pub-cdns6-mtnk-eth1.rpub.net.rogers.com

67.231.208.229:53
pub-cdns4-ym-eth1.rpub.net.rogers.com

209.148.131.40:53
pub-cdns5-mtnk-eth1.rpub.net.rogers.com

67.231.208.228:53
pub-cdns3-ym-eth1.rpub.net.rogers.com

209.148.131.36:53
pub-cdns1-mtnk-eth1.rpub.net.rogers.com

67.231.208.227:53
pub-cdns2-ym-eth1.rpub.net.rogers.com

209.148.131.37:53
pub-cdns2-mtnk-eth1.rpub.net.rogers.com

Please advise.

*Edited Labels*

[RogersDave]

Hi @Double_K,

I started discussing this with our DNS engineering team and they are asking if you would have a traffic capture available for that.

If you can, reach out to me via PM and we'll see how you can sent that out to me.

Dave

[Double_K]

PM Sent

[Double_K · Accepted solution]

Just to close this off for anyone else reading this in the future.

This was not a security issue.

The Rogers DNS team has investigated and it appears it's a load-balancer/caching server timing issue for non-existent domains and the fact that my firewall rejects responses from servers it doesn't initiate contact with.

@RogersMoin can you please close this thread?

[LouisQ37]

Hello

after a vulnerability scan ...  found that rogers modem has many of open access /port that could expose customers to bad guys..     

Could Rogers explains why many ports  are open and why  the firewall are set to auto forwarding event if you block it.

see bellow :

DNS Server Cache Snooping Remote Information Disclosure

suggested Solution by  NESSUS scanner

Contact the vendor of the DNS software for a fix

***Edited Labels***

[AW10]

I'd like to reopen this issue as I've been the victim of a traffic hijack, though I cannot provide any technical information unless given the instructions to retrieve my traffic history, or something to that effect (it's been a while since I did anything to this effect), but I do have my Avast report.

Click here for details

* Avast Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Thursday, November 14, 2019 3:22:10 AM
*

11/20/2019 11:53:59 AM superdupercontests.com/pixeliframe.aspx?cnid=2200416  [L] HTML:Iframe-inf [Susp] (0)
11/20/2019 11:54:00 AM trckr.global/p.ashx?a=78&e=24&r=23565-429264405&t=13020275&fb=1   [L] URL:Blacklist (0)

The URL that slipped through was;

Click here for details

dealsonline24-7.com/lp/13f2f8cb557d267fa5cc1a9eeb8f29dc/757b505cfd34c64c85ca5b5690ee5293.html?browser={browser}&p=1&lpkey=156974ff262e902507&uclick=bza2k2b4fe#  

For the time being I've switched from Rogers DNS to OpenDNS to avoid further incidents, and while up to this point I've been happy with my service, being the victim of a fraud attempt has shaken me considerably.

[RogersAndy]

Hi @AW10.

Welcome to the Community!

Seeing any form of notification from an Anti-Virus can definitely come as a shock. In this case though this particular issue would not be related to Rogers DNS server. As per your alternative post "here" the issue appears to stem purely from a phishing attempt. I would recommend taking the appropriate actions if any personal information was provided (contacting credit card company etc.) and ensuring a full system scan is done to rule out or remove any intrusive malware.

@RogersAndy