Unknown client showing up in dashboard

Help
1

Under "Top Clients" I discovered several of the following entries:

node-8kr.pool-125-26.dynamic.totbb.net

When I hover the client entries over the links shown are actually:

  1. http://192.168../admin/queries.php?client=iPad.local

  2. http://192.168../admin/queries.php?client=DiskStation.local

When I hover over the other client entries, I get instead the IP address assigned by Pi-hole's DHCP server. I'm not sure what is happening here and would appreciate some insight in solving this mystery. Thanks.

2

I don't know why your links are like that, but a quick google brought me here. The short story is that totbb .net is part of some kind of spam and bruteforce botnet. My suspicion is that you've been infected.

3

An infection is indeed my worry. Not sure hot to investigate this matter.

The entry node-8kr.pool-125-26.dynamic.totbb.net is not displayed under top clients anymore but this doesn't give me peace of mind. I have one unknown hostname entry in the DHCP settings.

4

Does restarting FTL change anything?

sudo service pihole-FTL restart
5

No but I have now deleted the errant DHCP entries and will keep a close eye on it from now on. Thanks.

6

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.