diff --git a/mitmproxy/tools/web/app.py b/mitmproxy/tools/web/app.py
index ae2394eb0..9c13690a7 100644
--- a/mitmproxy/tools/web/app.py
+++ b/mitmproxy/tools/web/app.py
@@ -466,31 +466,7 @@ class SaveOptions(RequestHandler):
 class Application(tornado.web.Application):
     def __init__(self, master, debug):
         self.master = master
-        handlers = [
-            (r"/", IndexHandler),
-            (r"/filter-help(?:\.json)?", FilterHelp),
-            (r"/updates", ClientConnection),
-            (r"/events(?:\.json)?", Events),
-            (r"/flows(?:\.json)?", Flows),
-            (r"/flows/dump", DumpFlows),
-            (r"/flows/resume", ResumeFlows),
-            (r"/flows/kill", KillFlows),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)", FlowHandler),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/resume", ResumeFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/kill", KillFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/duplicate", DuplicateFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/replay", ReplayFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/revert", RevertFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/(?P<message>request|response)/content.data", FlowContent),
-            (
-                r"/flows/(?P<flow_id>[0-9a-f\-]+)/(?P<message>request|response)/content/(?P<content_view>[0-9a-zA-Z\-\_]+)(?:\.json)?",
-                FlowContentView),
-            (r"/settings(?:\.json)?", Settings),
-            (r"/clear", ClearAll),
-            (r"/options(?:\.json)?", Options),
-            (r"/options/save", SaveOptions)
-        ]
-        settings = dict(
+        super().__init__(
             template_path=os.path.join(os.path.dirname(__file__), "templates"),
             static_path=os.path.join(os.path.dirname(__file__), "static"),
             xsrf_cookies=True,
@@ -498,4 +474,32 @@ class Application(tornado.web.Application):
             debug=debug,
             autoreload=False,
         )
-        super().__init__(handlers, **settings)
+
+        self.add_handlers(
+            # make mitmweb accessible by IP only to prevent DNS rebinding.
+            r'(localhost|\d+\.\d+\.\d+\.\d+)',
+            [
+                (r"/", IndexHandler),
+                (r"/filter-help(?:\.json)?", FilterHelp),
+                (r"/updates", ClientConnection),
+                (r"/events(?:\.json)?", Events),
+                (r"/flows(?:\.json)?", Flows),
+                (r"/flows/dump", DumpFlows),
+                (r"/flows/resume", ResumeFlows),
+                (r"/flows/kill", KillFlows),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)", FlowHandler),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/resume", ResumeFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/kill", KillFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/duplicate", DuplicateFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/replay", ReplayFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/revert", RevertFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/(?P<message>request|response)/content.data", FlowContent),
+                (
+                    r"/flows/(?P<flow_id>[0-9a-f\-]+)/(?P<message>request|response)/content/(?P<content_view>[0-9a-zA-Z\-\_]+)(?:\.json)?",
+                    FlowContentView),
+                (r"/settings(?:\.json)?", Settings),
+                (r"/clear", ClearAll),
+                (r"/options(?:\.json)?", Options),
+                (r"/options/save", SaveOptions)
+            ]
+        )