[as112-ops] uceb.org "A" queries on AS112

[Daniel Suchy]

Hello,
I noticed interesting increase of A queries pointing to our AS112 node
(located at NIX.CZ, Prague) since last week.
I tried to find out cause, and discovered, that both nameservers of
domain "uceb.org" have glue records pointing to IP addresses used for
AS112 (blackhole-1.iana.org and blackhole-2.iana.org):

; <<>> DiG 9.5.0-P1 <<>> @a0.org.afilias-nst.info. uceb.org
; (2 servers found)
;; AUTHORITY SECTION:
uceb.org.		86400	IN	NS	ns1.uceb.org.
uceb.org.		86400	IN	NS	ns2.uceb.org.
;; ADDITIONAL SECTION:
ns1.uceb.org.		86400	IN	A	192.175.48.6
ns2.uceb.org.		86400	IN	A	192.175.48.42

Incoming A queries are for "ns1.uceb.org" and "ns2.uceb.org". Our
statistics are on http://as112.nix.cz/cgi-bin/bindgraph.cgi for reference.

I found, that uceb.org was some spam blacklist in the past, but it isn't
running now. Last change in the domain was on 12-Jul-2008 according to
the whois informations.

I think this is not normal behavior.

With regards,
Daniel

--
 __________________________________________________________________
 NIX.CZ z.s.p.o.                                email: ds at nix.cz
 Daniel Suchy, technical specialist             tel: +420 272660627
 Vinohradska 184, Praha 3                       fax: +420 272660629
 130 52 Czech Republic                          http://www.nix.cz