has anybody running Headscale ever seen their server get compromised and used to redirect certain DNS lookups thru the Tailscale resolver on clients to a different IP?
I have no idea if that's what I'm seeing with my setup right now, but my #Tailscale resolver is returning an entirely different IP for a certain DNS lookup than the correct one (which is returned by e.g. Google and Quad9). #Headscale #IOC #infosec
selfhosting.couchsurfing
npub1nq…6salp
2026-07-28 18:28:53 UTC
Author Public Key
npub1nq6ztqk0qhj0uay4yfpmdzs0cqt6wks7txn0kc28v5fyczte7kvsr6salpPublished at
2026-07-28 18:28:53 UTCEvent JSON
{
"id": "410569bc51207f420779e805ae0a99db651e86c4aaf3b81356d90e307f95e031",
"pubkey": "98342582cf05e4fe74952243b68a0fc017a75a1e59a6fb614765124c0979f599",
"created_at": 1785263333,
"kind": 1,
"tags": [
[
"t",
"tailscale"
],
[
"t",
"headscale"
],
[
"t",
"ioc"
],
[
"t",
"infosec"
],
[
"proxy",
"https://mastodon.pirateparty.be/users/surfhosting/statuses/116999017824152417",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "has anybody running Headscale ever seen their server get compromised and used to redirect certain DNS lookups thru the Tailscale resolver on clients to a different IP?\n\nI have no idea if that's what I'm seeing with my setup right now, but my #Tailscale resolver is returning an entirely different IP for a certain DNS lookup than the correct one (which is returned by e.g. Google and Quad9). #Headscale #IOC #infosec",
"sig": "78fb6dff38ebb1562994fa26588c5031410230d324909d3fada23e2d870d4685d46ace757993b3984cd8c1fbcedd359e042bd36c57c40634b342babadad092c2"
}