Is malware altering my destination ip

Question

Something strange is happening to my internet requests and I don't have the knowledge to know why it's happening.

I've suddenly started to be directed to google france whenever I do internet searches so I looked up my IP and ip location to see where google thought I was positioned and it turns out that my ip address had changed, the new ip address now belonged to a server in france, a server of an isp that is not my isp.

I checked the ip of my home router and the router's ip didn't match the new ip. I have two windows machines, one running w10 and the other w7, the problem happens on both machines. I also have android tablets and I have checked my ip on these tablets and the correct ip is returned with the correct location and the correct isp. all tablets and pcs are connected to the local network which should in theory share the same IP address(?).

I downloaded wireshark so I could see what was being sent and where, and I can see that packets are continually being sent and received by the ip address of the server in france.

To confuse things, this morning I looked up my ip on both pcs again and the correct ip, location and isp was returned however I checked wireshark and packets were still being sent and received to the ip of the server in France.

Is it possible that some malware is routing traffic to this server in France, and it has infected both my pcs through the network?

I don't use a vpn and don't have one configured. I checked in the windows settings and none were being used. I have scanned with avast and malwarebytes and they have turned up nothing. I'm currently running a microsoft safety scanner but it's not showing anything yet.

I just can't understand what is going on, but then again I have very limited knowledge of security and networking. Does anybody have more of a clue? I've been reading about Mitm attacks and thought this sounds similar.

Answer 1

I have seen this happening on some machines, with different target IPs (last one was in Texas, of all places: the actual server should have been in Northern Italy, not even on the same continent).

Verify your network configuration and manually set the DNS entry to Google's 8.8.8.8, and see whether this continues to happen or not.

What happened in my cases was that something had hijacked the routers, thanks to the fact that the users had left them with remote access enabled and trivial passwords (but I am advised that there somethings that can brute force entry or exploit router vulnerabilities), and reprogrammed the DNS sent via DHCP to the internal network so that DNS queries were routed to a rogue server.

The rogue server then replies to "most" DNS queries with the address of another rogue server, which is then able to hijack all of your communications. Google mail, home banking site, and so on. HTTPS encrypted connections will receive faked signed certificates, which may trigger a browser security alert... or not, depending on the browser.

I would carefully review the logins you've used while being hijacked, and consider those passwords compromised.

If the DNS trick works, your router is in all likelihood compromised also; I'd reset it to factory and secure it, unless you already secured it when you installed it, in which case it must be considered vulnerable and replaced with a new model, or its firmware updated if possible. You may want to Google your router's make and model and keywords such as "vulnerability", "botnet", "CVE".