Hi Robert Wy
I can't tell you why this only affects some computers. I checked two computers at my house, and it is only affecting one of them. I can tell you that with an earlier model of a Comcast modem, I did have it hijacked, which suggests that either the modem had a vulnerability, or Comcast allowed someone access to their password file (passwords to the modem, not my account).
This feels like a "broken" attempt to hijack my modem, but I really can't tell.
... View more
Just to add my 2¢ to the conversation.
I noticed about an hour ago that my internet connection was down, and then it came back up pretty quickly. I just looked at the modem status, and I can see that the modem rebooted just about an hour ago, so that explains the brief outage. Note that I did not reboot the modem, and we have had no problems with power, so clearly somebody outside (Comcast, or a bad actor) rebooted the modem.
Shortly after the reboot, my fire wall asks "automountd wants to connect to applications.utopia.com." And when I look at my internet panel I see "Search Domains: utopia.com". I have never seen this before. (I use Google's name servers on my computer—220.127.116.11 and 18.104.22.168—and they have not been changed.) The DNS servers reported by my modem continue to be Comcast's— 22.214.171.124 and 126.96.36.199.
So it looks like if this was a hijacking attempt (which I have had, with a different model of modem from Comcast), it isn't going to be too successful. But I have no opinion, yet, whether this is a hijacking attempt, or an intentional change of some sort at Comcast.
In any event, I solved it by blocking utopia.net with my firewall.
OS: High Sierra 10.13.3
Firewall: Little Snitch
... View more