I think a WPAD attack is happening in my home and I was not aware about what WPAD is until now. A svchost.exe process was connecting to some dubious IP (185, 38, 111, 1) through port 80 every 10 minutes. While going to wpad/wpad.dat in my browser I was receiving a blank page and I tried to block that IP in my firewall. After that, everytime I access wpad/wpad.dat my firewall blocks the connection because it's going to that IP. I did a factory reset on my router but the problem persisted. Searching about this situation, I found more people having the same problem with the same IP. One of those people said he deal with it just by changing his router's DHCP Domain Name. I decided to try it and I changed mine (which was always "domain.name") to something random, like "sweet.candy".
I tested that suggestion for a entire day and, for my surprise, the problem suddenly stopped and that connection didn't appear anymore. Going to wpad/wpad.dat now, I'm receiving a message saying that my browser could not reach that address (which was, according to that person's suggestion, the desired outcome). However, after that, I read this Sophos article, which says we shouldn't make up domain names, so I reverted DHCP Domain Name back to "domain.name".
I already turned off "Automatically detect proxy settings" in my PC, but there is one PC in my network which was connecting to that malicious IP too even with that option having always being off.
- Where is the wpad.dat file? Is it in the router or in my PC? Is there a way to edit it?
- If is it in router, how is it possible that a factory reset didn't revert it to normal state?
- Does change router's DHCP Domain Name just hide the attack or really solves it? And does change it imposes any risk?
- Are devices other than PCs, like smartphones, affected by this attack?
- It seems some people get rid of this attack after changing the router. Even if I do that, how can I protect the next router against this attack?