DNS Rebinding - RFC1918 Private IP Returned by External DNS Server

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule monitors incoming DNS traffic for A record responses containing RFC1918 private IP addresses (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). This behavior is characteristic of DNS rebinding attacks, where a malicious web service resolves to a victim's internal network address to bypass browser same-origin policies.