DNS pinning does not protect against sophisticated DNS rebinding attacks.
- The TTL has expired on your first DNS request, but DNS pinning is still in effect
- You made a request back to the attacker's website via their JS AJAX call
- The request was dropped by the attacker's firewall
These three things will cause your web browser to send another DNS query despite the fact that you are using DNS pinning. In effect, the attacker has easily defeated your DNS pinning strategy by using a firewall and sending a second request outside of the TTL. DNS pinning isn't an effective strategy because there are plenty of legitimate reasons why someone's server might be down; your browser is forced to make a second DNS query in case there is another DNS record that will resolve to the correct machine (e.g. in case of a server migration, downtime, whatever). Basically, your browser has no way of knowing whether or not it's actually being attacked here; for all it knows, the server is legitimately down and so, it MUST make another DNS request.
So... why does it matter that there's a second DNS request?
Preventing the DNS rebinding attack
There are a bunch of ways to prevent it, and I'm pretty sure modern browsers already have implemented protection against these attacks. One easy way to prevent it (as a web owner) is to check the HTTP host header of a request. For example if you are google.com then you would receive a request but the host header would still say attacker.com. Obviously that isn't part of your domain, so you can prevent the attack simply by dropping the request. Why would someone want to do this to begin with? Well, click fraud in advertising. Scraping search engines from many machines at once. Stealing valuable data from web sites on your internal company network. Etc.