[GH-ISSUE #313] Why are agents repeatedly looking up icanhazip.xlawgaming.com? #2148

New issue

Closed

opened 2026-03-14 02:46:10 +03:00 by kerem · 4 comments

kerem commented

2026-03-14 02:46:10 +03:00

Owner

Originally created by @djsvi on GitHub (Mar 6, 2021).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/313

I've noticed the RMM agents are regularly (every 5-10 minutes) requesting DNS resolution of icanhazip.xlawgaming.com.

Why is this?

Thanks.

Originally created by @djsvi on GitHub (Mar 6, 2021). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/313 I've noticed the RMM agents are regularly (every 5-10 minutes) requesting DNS resolution of icanhazip.xlawgaming.com. Why is this? Thanks.

kerem closed this issue

2026-03-14 02:46:17 +03:00

kerem commented

2026-03-14 02:46:24 +03:00

Author

Owner

@wh1te909 commented on GitHub (Mar 6, 2021):

it's how the agent gets the public ip that's displayed in the summary tab in the web gui

xlawgaming.com is a domain i own. starting from agent 1.4.8 I changed it to tacticalrmm.io which i also own but same code, you can find here https://github.com/wh1te909/icanhazip

agent needs to hit an external website to get the real public ip, since alot of people run their RMM behind nat so public ip would actually return a local ip if i were to use the rmm to extract it

and you can find the public ip function of the agent here github.com/wh1te909/rmmagent@cc13a14679/agent/utils.go (L23)

@wh1te909 commented on GitHub (Mar 6, 2021): it's how the agent gets the public ip that's displayed in the summary tab in the web gui `xlawgaming.com` is a domain i own. starting from agent 1.4.8 I changed it to `tacticalrmm.io` which i also own but same code, you can find here https://github.com/wh1te909/icanhazip agent needs to hit an external website to get the real public ip, since alot of people run their RMM behind nat so public ip would actually return a local ip if i were to use the rmm to extract it and you can find the public ip function of the agent here https://github.com/wh1te909/rmmagent/blob/cc13a1467984d19a7578d03771e422484158825e/agent/utils.go#L23

kerem commented

2026-03-14 02:46:29 +03:00

Author

Owner

@githubbiswb commented on GitHub (Mar 6, 2021):

Would you consider using another source? Would save you the traffic, and its name would be a bit more obvious to those watching their network traffic something like the following which I run in batch scripts for this same kind of purpose

nslookup myip.opendns.com resolver1.opendns.com

@githubbiswb commented on GitHub (Mar 6, 2021): Would you consider using another source? Would save you the traffic, and its name would be a bit more obvious to those watching their network traffic something like the following which I run in batch scripts for this same kind of purpose nslookup myip.opendns.com resolver1.opendns.com

kerem commented

2026-03-14 02:46:34 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 6, 2021):

Once it’s using tacticalrmm.io it will be obvious what it’s for. No need to spam other servers for this.

@dinger1986 commented on GitHub (Mar 6, 2021): Once it’s using tacticalrmm.io it will be obvious what it’s for. No need to spam other servers for this.

kerem commented

2026-03-14 02:46:39 +03:00

Author

Owner

@wh1te909 commented on GitHub (Mar 6, 2021):

thank you @dinger1986 yea agent 1.4.8 was released last week so update your rmms and then once your agents update they'll start hitting icanhazip.tacticalrmm.io also this gives me more control for example there was a recent feature request to prefer ipv4 instead of ipv6 for the agent

@githubbiswb traffic is not an issue, am using cloudflare plus my vm's have unmetered bandwith

@wh1te909 commented on GitHub (Mar 6, 2021): thank you @dinger1986 yea agent 1.4.8 was released last week so update your rmms and then once your agents update they'll start hitting `icanhazip.tacticalrmm.io` also this gives me more control for example there was a recent feature request to prefer ipv4 instead of ipv6 for the agent @githubbiswb traffic is not an issue, am using cloudflare plus my vm's have unmetered bandwith