One of the users of our RouterCheck tool was complaining about random popups containing ads in Spanish and Russian. Upon investigation, we found that the DNS settings on his router were changed to
93.158.212.36
I'm not aware of this DNS Server being problematic, but I have some suspicions.
Does anyone know if this server is known to be rogue?
If not, what should be done to test whether it is?
Finally, if it is, what next?? Do we submit to CERT?
Does anyone know if this server is known to be rogue? If not, what should be done to test whether it is?
Using tools like the one you used is one way to see if your DNS has been hijack, but it is not foolproof. In this case you may have a false positive as the address in question is owned by serverius. They offer a wide range of network services which could legitimately explain why that IP was set as the routers primary DNS server. I would investigate if they are a vendor to your organisation (or network provider). There is a chance that the popups and DNS settings are unconnected. (Although they may indeed be connected, obviously I do not have the information to make that judgement.)
Finally, if it is, what next?? Do we submit to CERT?
If the IP was in fact being used for malicious purposes you could submit it to various groups to investigate and have it placed into their blacklists or reputational databases. Examples of these groups are amongst others, the various national CERT groups. Gaining access to the CERT groups is different depending on what country you are in. The UK for example allows users who belong to various organisations across industry and government to apply to join online.
Many vendors such as Symantec and McAfee also allow you to submit IP's you believe to be rouge for investigation, normally via their customer portals.
The information on these lists is only of use if you have both access to it and make use of it in some way. Even then black lists and reputational databases are not a magic bullet as malicious IP's are an extremely dynamic entity and one that is very easy to subvert.
For quick investigations I usually use the Internet Storm Centre IP checker and IPVoid which is a meta site for many open source intelligence based blacklists and reputation lists. This is a good way to quickly find out if a particular IP is known for being connected to malicious activity.
