Host Windows Process accessing MyFiosGateway on different ports?

[AutoRepair]

Hi -

I just noticed this the other day and trying to figure out if this is 'normal' or not?

But my PC is accessing myfiosgateway.com as both a  host windows process and also as a NT Kernal event??  And with different PORTs. (i.e. 41530)??  The region listed is 'localhost'.  Usually when PC is idle.

Is this by design or do I need to buy a better net security suite??

I also thought I saw Verizon was no longer using myfiosgateway.com??   So it seems a little strange / out of place.

Any feedback?  suggestions?

[Cang_Household]

Where are you seeing this domain name? Did you purge your Window's DNS entries?

[AutoRepair]

No, I have not purged DNS.  But a couple days ago I did change them to NextDNS to see what that was all about.  Then changed them back 😉  Trying to learn about the internal workings a bit.  Was using Glasswire to see the myfiosgateway.com link.

How would I purge the DNS cache?  And should I purge the cache?

Thanks much.

[Cang_Household]

It seems that the Glasswire is mapping the Domain Name myfiosgateway.com to your router's IP address. Did you ever accessed your router's GUI through myfiosgateway.com? If you did, this may be saved in your DNS cache. Glasswire probably reads your DNS cache.

Is your router still reachable by myfiosgateway.com?

Do you have this entry under your router's Advanced > DNS server? I suspect you do.

[smith6612]

If it's coming from the Kernel, it's usually something related to the network stack. Are you using any software on your machine, especially video games or VoIP software, which might be utilizing UPnP? Or, do you have Network Discovery enabled? These can often cause your PC to communicate with the router directly.

If you are worried, do a one-over scan with MalwareBytes on your PC.

[AutoRepair]

Hey - Thanks for the reply.

Yes, I did access the GUI from myfiosgateway.com (firefox) a couple days ago, because I wasn't paying attention and instead of 192.168.1.1, I used myfiosgateway.com (from an old post online suggestion). 

I am using bitdefender and it said the site myfiosgateway.com wasn't secure.  But I went there anyway.  Which is why I am a little concerned.

I accessed the Advanced DNS entry and it only shows one entry - 'my PC name 192.168.1.151  DHCP'.

And just now, when I tried to access myfiosgateway.com, bitdefender told me again it wasn't secure and was potentially malicious.  And I clicked ok, and didn't even need a password to access the router??  Bitdefender is now continuously tells me that site isn't safe with multiple warnings.  I had to tell it to ignore security scan this session to even access the router from either 192.168.1.1 OR myfiosgateway.com.  When I went to the 192.168.1.1 I got the FIOS logo and it said it was switching it over to myfiosgateway.com for 'security' reasons??

Last night I cleared the DNS cache through ipconfig.  But still having same issues this morning (if this is an issue).  Both bitdefender and Malwarebytes ran clean.

[AutoRepair]

reply to Smith - Hello and thanks for the reply.

Yes, I do use both discord and Steam for video games.   I have discovery turned off in network settings.  However, neither are currently active / running.

I also do see UPnP running and SSDP services running in services list.

I ran malware scan, and it came back clean.

But would still like to have things go back to the way they were...both on my PC and pre-Corona - haha.

I am trying to learn how my PC and networking works and am quickly realizing it's pretty complicated 😉

[AutoRepair]

Update - In glasswire I found a setting to 'Lookup DNS names for Hosts' - which I turned on.

Now the Firewall is showing 'FIOS Quantum Gateway Router - home' as the name instead of myfiosgateway.com.

So maybe just a glasswire naming issue as suggested by Cang?

[Cang_Household · Accepted solution]

Glasswire likely maps myfiosgateway.com to 192.168.1.1 for user's ease of identification.

This is done by WireShark also. The Privacy Error page of the router GUI is normal behavior since the SSL certificate is self-assigned.

[AutoRepair]

Thanks to you (Cang) and Smith for the help 🙂