So by opening an application/browser on my Android device, I found that it pops open a set of ads. I channeled a proxy through my laptop trying to track the first web site it connects to. Later I found out that my router DNS is the same as that server that pops open the ads. Also I found that my /etc/resolv.conf contains the same DNS but it was printed by the network manager. So scenarios are:

  1. My mobile device was infected and attacker accessed my router since it has different kinds of vulnerabilities and changed the DNS there. Then network manager prints it to my /etc/resolv.conf
  2. My laptop was infected (highly unlikely since its a new device nothing untrusted installed)
  3. Attacker accessed the router first then some how figured to infect apps on my android device and this DNS change in /etc/resolv.conf also happened by network manager just copying router's dns to my system

So the question is how to debug this situation? How to figure out the core problem here, also many apps are infected on my android device? I tried different anti-virus but no luck. Also I would appreciate a word of advice on reporting the attacker here since I believe this could be a sort of mass attacks on the routers within my IP address range.

  • 1
    Have you searched the reputation of the suspect DNS ip? It is a network indicator that might point you in the right direction to proceed.
    – dotproi
    Commented Aug 22, 2016 at 22:49

1 Answer 1


It is most likely that your router was infected and android takes its dns server from dhcp. There are a few driveby attacks that work on routers like this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .