Does this look normal or is it botnet like activity?

Follow

bwsur

January 10, 2014 03:41

Our network is with rogers and looking at the domains statbox we're getting thousands of hits at:

*.phub.net.cable.rogers.com

Opendns says its okay.. And looking online I guess everything would go through the hub so it kind of makes sense.  Any help would be greatly appreciated.  Maybe try turning on suspicious responses protection?

0

• 

  rotblitz January 10, 2014 14:23

  As clearly can be seen from the domain name, you had to ask your ISP what the purpose of this is.  It may be something configured in your router, or some ISP software installed on your devices.  It looks like a so called DNS suffix.

  "Does this look normal or is it botnet like activity?"

  Neither.

  "Maybe try turning on suspicious responses protection?"

  Certainly not.  OpenDNS is not the cause, but it reports the symptom only.  There would be the same activity and traffic with any other DNS service, inc your ISP's.

  You may be able to get rid of this by removing the DNS suffix phub.net.cable.rogers.com from your router and/or your computer configuration.

  See also https://startpage.com/do/search?q=%22phub.net.cable.rogers.com%22

  0

  Comment actions Permalink
• 

  bwsur January 10, 2014 14:45

  Great advice.  I'm going to contact my ISP first to inquire about it.  Thanks.

  0

  Comment actions Permalink

Please sign in to leave a comment.