MCP DNS Rebinding Attack — Hostname Time-Based IP Switching
Attackers use a trick called DNS rebinding to sneak past an AI agent's origin checks and reach MCP servers running on a victim's own machine, like ones listening on localhost or an internal network. This lets them read or control a locally running tool through content the agent loaded from the web.
How the attack works
An attacker gets the agent or browser to load a page or script pointing to a hostname they control, such as one using rebind.network, rbndr.us, or nip.io. That hostname first resolves to the attacker's own server, passing any initial origin check the agent performs. After the connection is trusted, the DNS record is switched (rebound) to a local or internal IP address such as 127.0.0.1 or a 192.168.x.x address, redirecting the already-established connection to the victim's local MCP server. The attacker can then send requests to that local server as if they were the legitimate client, reading data or issuing commands the server would otherwise refuse from an external source.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f28ad3ef-bf58-41a5-b362-fbc04ebe4d3f
- Severity
- Critical
Why it matters
An attacker can interact with an MCP server that was only meant to be reachable locally, potentially exposing sensitive data or letting the attacker trigger tool actions without authorization.
What you can do
- →Bind local MCP servers to loopback only where possible and require authentication even for local connections.
- →Do not rely on hostname or origin checks alone to establish trust — validate the actual resolved IP at connection time and re-validate on each request.
- →Block or flag outbound DNS resolutions to known rebinding services (rebind.network, rbndr.us, nip.io) at the network or client level.
- →Review agent/browser configurations for support of strict origin pinning that ties a connection to a fixed IP for its lifetime, not just at initial handshake.
Known benign look-alikes
- Security research documentation describing DNS rebinding techniques — these appear in papers and blog posts, not in live tool outputs
- ATR test fixtures containing rebind.network examples as labeled attack samples