Sounds weird! What are the configuration you have done on the router? Are you using a DDNS server from a root-servers.net or is there any device in your house use that website's service? How about reboot the router or even reset?

I switched eveything else off for a couple of hours. It was still ticking away at about 115 requests / hour

I have the same problem with my DSL Router, Archer D7 v1 FW. 0.9.1 0.5 v002d.0 Build 140225 Rel.37189n

In Opendns logs I noticed I had over 5000 quires to a.root-servers.net in the past week, whereas my second most quired is just a couple of hundreds.

I am seriously suspicious of TP Link now, since I have discovered that they have a tendency to leave backdoors in routers.

"Polish security researchers have found a backdoor in TP-Link routers, allowing an attacker to not only gain root access to the local network, but also to knock down the router via a CSRF attack remotely. (Further information — Google translation of Russian original). According to the researchers, TP-Link hasn't yet responded to give an answer about issue. The good news: Users who replaced their TP-Link firmware with Open/DD-WRT firmware can sleep well."

http://sekurak.pl/tp-link-httptftp-backdoor/



Anyone cares to shed some light on this?