I have an ASUS RT-AC66U router, and I'm not the most tech-savvy individual. Earlier today, the router login prompt appeared in my browser, even though I hadn't gone to 192.168.1.1. I was nervous about it, so I installed the latest firmware update from the router web app (not ASUS's website), then decided to reset to factory and change all the passwords. To the best of my knowledge, all of the vulnerable ASUS settings are disabled. F-Secure's Router Check gave me a "clear" report before and after the firmware update.
A few hours later, while in the System Log, I noticed the Active Connections tab has some unusual destinations. I attempted to plug some of these into Google, assuming they would show the websites I had visited. When that didn't work (I was mostly getting IP lookup results), I began plugging the addresses into VirusTotal after noticing it appearing in my search results. I noticed one in particular was showing server names advertising porn websites in the WHOIS lookup.
My DNS servers appear to be legitimate Charter servers, and at some point in this process I changed them to Google's DNS servers. I rarely go to websites I'm not familiar with, so I can't understand why these connections would be showing up. I'm somewhat concerned about the firmware update, since ASUS's servers aren't HTTPS. I've also never poked around in Active Connections before, so I have no clue if it's typical for these sorts of things to show up.
Any help here would be sincerely appreciated! For whatever reason, I'm extremely nervous about my router being compromised. I do have an Apple Airport Express that I haven't set up as a router, and I'm tempted to switch to that as opposed to the AC66U.
A small update...
I've turned my Wi-Fi off and on a few times to clear the Active Connections. It never clears fully (I'm not sure if it should?), and there are more connections than I have websites open (11 to 4). Strange IP addresses are still showing up (mostly as TIME_WAIT, though some as ESTABLISHED), though not necessarily the same ones each time.
Rebooting the router clears the Active Connections almost entirely. Briefly there were 4 established connections to 4 tabs open (though I'm not certain if they matched). I ran one IP (188.8.131.52, which I believe is stackexchange's) through VirusTotal, and immediately, several new ESTABLISHED connections showed in the Activity Log. They appear to be dropping off as time passes, but there are still 6 connections to 4 websites open.