Malware on my Pi?

Help
1

I don't know if this relates to Pi-Hole or is specific to my Raspberry Pi, but I noticed the following in the Pi-Hole log and in the query log:

Feb 16 11:06:15 dnsmasq[575]: query[A] news.livejasmin.com from 127.0.0.1
Feb 16 11:06:15 dnsmasq[575]: gravity blocked news.livejasmin.com is 0.0.0.0
Feb 16 11:06:15 dnsmasq[575]: query[A] news.livejasmin.com from 192.168.1.81
Feb 16 11:06:15 dnsmasq[575]: gravity blocked news.livejasmin.com is 0.0.0.0
Feb 16 11:06:16 dnsmasq[575]: query[PTR] 81.1.168.192.in-addr.arpa from 127.0.0.1
Feb 16 11:06:16 dnsmasq[575]: /etc/pihole/local.list 192.168.1.81 is raspberrypi3

It does appear to have originated from the Raspberry Pi and nowhere else. I've googled the domain name and it's a porn camera site, I've no idea what on my Rasp Pi would be trying to contact that address unless there's malware on my Pi? If so I dunno how as it only runs Pi-Hole, isn't internet-facing or a port-forwarding endpoint from my router.

Any suggestions what to do next?

2

Did the domain appear only once or twice?

From your debug log of the other topic you opened

Name resolution (IPv4) using a random blocked domain and a known ad-serving domain
[✓] news.livejasmin.com is 0.0.0.0 via localhost (127.0.0.1)
[✓] news.livejasmin.com is 0.0.0.0 via Pi-hole (192.168.1.81)

It's the debug script requesting the domains.

3

LOL, wish I'd read the debug file now :blush: :blush:

It appeared twice in the log, for localhost and then for raspberrypi3 (the hostname for 192,168.1.81), but I guess that's one request.