title: MCP DNS Rebinding Attack — Hostname Time-Based IP Switching
id: ATR-2026-01307
rule_version: 1
status: experimental
description: |
  Detects DNS rebinding attack payloads targeting MCP servers. DNS rebinding exploits the browser/client same-origin policy by initially resolving a hostname to an attacker-controlled IP (bypassing the agent's origin checks), then rebinding the DNS to a local/internal IP (e.g., 192.168.x.x or 127.0.0.1) after the connection is established. This lets an attacker read or manipulate a locally running MCP server through a victim browser/agent that loaded attacker-controlled content. The canonical payload format uses rebind.network, rbndr.us, nip.io, or 1time/forever TTL suffixes. MCPSecBench probe: <script>window.location = 'http://A.192.168.1.10.1time.127.0.0.1.forever. <uuid>.rebind.network:9001'</script>
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
  mitre_atlas:
    - AML.T0078 - Drive-by Compromise
  cve:
    - DNS rebinding attack class — SSRF via DNS temporal binding
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of DNS rebinding payloads targeting MCP servers supports runtime security measurement for agent infrastructure.
      strength: primary
    - subcategory: MG.2.3
      context: DNS rebinding requires immediate risk treatment to prevent SSRF access to internal MCP services.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 operational control requires detection of DNS rebinding attacks against MCP server infrastructure.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 risk treatment is supported by blocking DNS rebinding payloads before they reach MCP clients.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 cybersecurity requires detection of network-layer attacks like DNS rebinding targeting AI agent infrastructure.
      strength: primary
    - article: '9'
      context: Article 9 risk management requires controls over DNS rebinding attack vectors.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: mcp-dns-rebinding
  scan_target: tool_output
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Security research documentation describing DNS rebinding techniques — these appear in papers and blog posts, not in live tool outputs
    - ATR test fixtures containing rebind.network examples as labeled attack samples
  conditions:
    - field: content
      operator: regex
      value: (?i)\b[a-zA-Z0-9.-]{1,253}\.(?:rebind\.network|rbndr\.us|rebinder\.com|1u\.ms)\b
      description: Known DNS rebinding service hostname (rebind.network, rbndr.us, etc.)
    - field: content
      operator: regex
      value: (?i)(?:1time|forever|ttl\d+|0ttl)[\w.-]{1,253}(?:127\.0\.0\.1|192\.168\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[0-1])\.\d+\.\d+)
      description: Time-based DNS rebinding hostname pattern combining public IP with loopback/private IP
    - field: content
      operator: regex
      value: (?i)<\s*script[^>]{0,80}>\s*(?:window\.location|document\.location|location\.href)\s*=\s*['"]?https?://[a-zA-Z0-9.-]{10,200}(?:rebind|rbndr|1time|forever)[a-zA-Z0-9.-]*:[0-9]{2,5}
      description: Script tag with window.location redirect to DNS rebinding hostname — MCPSecBench exact pattern
    - field: content
      operator: regex
      value: (?i)(?:127\.0\.0\.1|localhost|::1)\s*:\s*(?:900[0-9]|8[0-9]{3}|3[0-9]{3})\b[^"]{0,200}(?:rebind|1time|forever|rbndr)
      description: Loopback address with common MCP server port referenced alongside rebinding terminology
response:
  actions:
    - alert
    - block_tool
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-01307] CRITICAL: DNS rebinding attack payload detected. The content references a DNS rebinding service (rebind.network, rbndr.us) or uses the canonical time-based rebinding hostname pattern targeting internal MCP services. This attack can redirect agent traffic to attacker-controlled infrastructure while appearing to access a trusted local endpoint.