Crashes, possibly related to fire stick malware

[bibikalka1]

Versions

• Pi-hole:
• Web:
• FTL:

Entware Package 2026.02.18-1Core v6.4FTL v6.5Web interface v6.4.1

Platform

• OS and version:

• Platform: Asus Merlin router

https://www.snbforums.com/threads/pi-hole-directly-on-the-router-yes.90719/page-23#post-986431

The crashes are possibly related to some new malware
https://www.snbforums.com/threads/pi-hole-directly-on-the-router-yes.90719/page-23#post-986454

Expected behavior

A clear and concise description of what you expected to happen.

Actual behavior / bug

A clear and concise description of what the bug is.

Steps to reproduce

Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Debug Token

• URL:

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

[yubiuser]

Please post the relevant log output here and provide a debug token. Thanks.

[bibikalka1]

@yubiuser

Token:
https://lurking-cat.appspot.com/upload/gPg8aCcu

Logs around crash time:
2026-03-06 07:07:01.737 CST [5583M] INFO: Rate-limiting 192.168.1.190 for at least 12 seconds
2026-03-06 07:07:13.996 CST [5583/T5612] INFO: Still rate-limiting 192.168.1.190 as it made additional 24698 queries
2026-03-06 07:07:59.753 CST [5583M] INFO: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2026-03-06 07:07:59.753 CST [5583M] INFO: ----------------------------> FTL crashed! <----------------------------
2026-03-06 07:07:59.753 CST [5583M] INFO: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2026-03-06 07:07:59.753 CST [5583M] INFO: Please report a bug at https://github.com/pi-hole/FTL/issues
2026-03-06 07:07:59.753 CST [5583M] INFO: and include in your report already the following details:
2026-03-06 07:07:59.753 CST [5583M] INFO: FTL has been running for 8329 seconds
2026-03-06 07:07:59.753 CST [5583M] INFO: FTL branch: master
2026-03-06 07:07:59.753 CST [5583M] INFO: FTL version: v6.5
2026-03-06 07:07:59.754 CST [5583M] INFO: FTL commit: f888309
2026-03-06 07:07:59.754 CST [5583M] INFO: FTL date: 2026-02-17 20:20:12 +0000
2026-03-06 07:07:59.754 CST [5583M] INFO: FTL user: started as pihole, ended as pihole
2026-03-06 07:07:59.754 CST [5583M] INFO: Compiled for linux/arm64/v8 (compiled on CI) using cc (Alpine 15.2.0) 15.2.0
2026-03-06 07:07:59.754 CST [5583M] INFO: Process details: MID: 5583
2026-03-06 07:07:59.754 CST [5583M] INFO: PID: 5583
2026-03-06 07:07:59.754 CST [5583M] INFO: TID: 5583
2026-03-06 07:07:59.754 CST [5583M] INFO: Name: pihole-FTL
2026-03-06 07:07:59.754 CST [5583M] INFO: Received signal: Segmentation fault
2026-03-06 07:07:59.754 CST [5583M] INFO: at address: 0
2026-03-06 07:07:59.754 CST [5583M] INFO: with code: SEGV_MAPERR (Address not mapped to object)
2026-03-06 07:07:59.754 CST [5583M] INFO: !!! INFO: pihole-FTL has not been compiled with glibc/backtrace support, not generating one !!!
2026-03-06 07:07:59.754 CST [5583M] INFO: ------ Listing content of directory /dev/shm ------
2026-03-06 07:07:59.754 CST [5583M] INFO: File Mode User:Group Size Filename
2026-03-06 07:07:59.754 CST [5583M] INFO: rwxrwxrwx admin:root 360 .
2026-03-06 07:07:59.756 CST [5583M] INFO: rwxr-xr-x admin:root 3k ..
2026-03-06 07:07:59.756 CST [5583M] INFO: rw------- pihole:pihole 768k FTL-5558-recycler
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 8k FTL-5558-dns-cache-lookup
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 16k FTL-5558-domains-lookup
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 4k FTL-5558-clients-lookup
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 555k FTL-5558-fifo-log
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 4k FTL-5558-per-client-regex
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 48k FTL-5558-dns-cache
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 8k FTL-5558-overTime
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 3M FTL-5558-queries
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 28k FTL-5558-upstreams
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 340k FTL-5558-clients
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 60k FTL-5558-domains
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 120k FTL-5558-strings
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 144 FTL-5558-settings
2026-03-06 07:07:59.757 CST [5583M] INFO: rw------- pihole:pihole 344 FTL-5558-counters
2026-03-06 07:07:59.758 CST [5583M] INFO: rw------- pihole:pihole 120 FTL-5558-lock
2026-03-06 07:07:59.758 CST [5583M] INFO: ---------------------------------------------------
2026-03-06 07:07:59.758 CST [5583M] INFO: Please also include some lines from above the !!!!!!!!! header.
2026-03-06 07:07:59.758 CST [5583M] INFO: Thank you for helping us to improve our FTL engine!
2026-03-06 07:07:59.758 CST [5583M] INFO: Waiting for threads to join
2026-03-06 07:07:59.758 CST [5583M] INFO: Thread database (0) is idle, terminating it.
2026-03-06 07:07:59.758 CST [5583M] INFO: Thread housekeeper (1) is idle, terminating it.
2026-03-06 07:07:59.759 CST [5583M] INFO: Thread dns-client (2) is idle, terminating it.
2026-03-06 07:07:59.759 CST [5583M] INFO: Thread timer (3) is idle, terminating it.
2026-03-06 07:07:59.759 CST [5583M] INFO: Thread webserver (7) is idle, terminating it.
2026-03-06 07:07:59.759 CST [5583M] INFO: All threads joined
2026-03-06 07:07:59.760 CST [5583M] INFO: PID file emptied
2026-03-06 07:07:59.762 CST [5583M] INFO: Stored 0 API sessions in the database
2026-03-06 07:08:00.639 CST [5583M] INFO: ########## FTL terminated after 2h 18m 50s (code 1)! ##########
2026-03-06 07:22:58.504 CST [452189M] INFO: ########## FTL started on RT-AC86U-9988! ##########

[bibikalka1]

@yubiuser

It seems like those weird sites are trying to crash DNS resolver, see the pihole.log around that crash time.

pihole_sel.zip

Rate limiting messages appeared roughly in the same time frame when it started crashing:

grep Rate FTL.log

2026-03-02 01:43:39.190 CST [3705M] INFO: Rate-limiting 192.168.1.190 for at least 17 seconds
2026-03-02 04:50:47.472 CST [3700M] INFO: Rate-limiting 192.168.1.190 for at least 52 seconds
2026-03-03 04:30:31.731 CST [4230M] INFO: Rate-limiting 192.168.1.190 for at least 14 seconds
2026-03-04 05:08:31.588 CST [4097M] INFO: Rate-limiting 192.168.1.190 for at least 12 seconds
2026-03-04 17:17:03.481 CST [5721M] INFO: Rate-limiting 192.168.1.190 for at least 51 seconds
2026-03-06 07:07:01.737 CST [5583M] INFO: Rate-limiting 192.168.1.190 for at least 12 seconds

[bibikalka1]

The list of these new malware sites in question:

okiloveyoupleasedonttouchme.net | 1528 |  
thespacemachines.st | 1528 |  
iloveyourweewee.bz | 1527 |  
imsowiwiwiwiwi.com | 1527 |  

Domain Hits Frequency [okiloveyoupleasedonttouchme.net](http://192.168.1.20/admin/queries?domain=okiloveyoupleasedonttouchme.net&upstream=permitted) 1528 [thespacemachines.st](http://192.168.1.20/admin/queries?domain=thespacemachines.st&upstream=permitted) 1528 [iloveyourweewee.bz](http://192.168.1.20/admin/queries?domain=iloveyourweewee.bz&upstream=permitted) 1527 [imsowiwiwiwiwi.com](http://192.168.1.20/admin/queries?domain=imsowiwiwiwiwi.com&upstream=permitted) 1527

[bibikalka1]

It looks like a streaming app pulled in a Trojan apk. Windows reports it as "Trojan:AndroidOS/AVerseFalc!rfn"

Here is the zip of it, I found it in /data/local/tmp on Android.

[Removed Link To Malware]

P.S. In a way, this malware is a good stress test. PiHole should not crash even then ...

[rdwebdesign]

I removed the link, but I kept the URL in your comment.

Please, do not post links to malware!

[jacklul]

Token:
https://lurking-cat.appspot.com/upload/gPg8aCcu

Developers will not be able to access this.

You should use the following to upload to their server:

cat /opt/var/log/pihole/pihole_debug.log | pihole tricorder original

(pihole debug output mentions this, I think you missed it)

[yubiuser]

You experienced a real FTL crash. Can you reliably reproduce the issue?
To help further debug this crash, I'd like to ask you to attach the gdb debugger as documented here:
https://docs.pi-hole.net/ftldns/gdb/

Once it crashes, please share the output of the gdb screen.

[PromoFaux]

This whole thread is suss, the "token" link the OP provided links directly to somewhere asking for access to a google account

OP has attached zip files - one which they openly admit contains malware, the other which there is no way in hell anyone should download just based on the other...

Retracted, see below

[jacklul]

@PromoFaux They are running Pi-hole using my packaged version for Entware - https://github.com/jacklul/entware-pi-hole

I patch the debug log upload code and change the server URL to my app so that I can assist people reporting issues, I left a way to upload to the original tricorder which I think they didn't notice:

[PromoFaux]

Ah! OK, my hackles were already up with the malware link, and then when I saw this link (for something I was previously unaware of) asking for my google account login I was about ready to start flipping tables... (╯°□°）╯︵ ┻━┻

We can put it back and I'll mind my own business 😉 ┬─┬ノ( º _ ºノ)

[bibikalka1]

@yubiuser @jacklul

Here is the proper token:
https://tricorder.pi-hole.net/tVqVUeoU/

I think the bug might be reproduced by setting up some clients which would hit PiHole with a bunch of DNS requests to the same sites - what malware was doing.

I removed my malware, so hopefully even this version won't crash again.

My settings:
[dns.rateLimit]
count = 10000 ### CHANGED, default = 1000

[bibikalka1]

@yubiuser @PromoFaux

So I wonder if pihole has a stress test before release.

Basically, it should get hit with way more dns requests than it can handle, this way weak spots would show up. One should also keep increasing dns.rateLimit while doing that.

While my discovery was through a malware it still highlighted something that should be investigated.

P.S. here is a stress test tool
https://github.com/RuisSoftware/Pi-Hole-Stress-Test

[yubiuser]

Basically, it should get hit with way more dns requests than it can handle, this way weak spots would show up.

If your hardware is beefy enough there should be no limit FTL itself can handle. But it might be a good idea to add a test for rate-limit to our test-suite.