[as112-ops] uceb.org "A" queries on AS112

[Peter Koch]

Daniel,

> I noticed interesting increase of A queries pointing to our AS112 node
> (located at NIX.CZ, Prague) since last week.

thanks for sharing this observation. We can confirm this for the DENIC
node operated at DE-CIX. Starting around 1400 UTC on 16 July, queries for
uceb.org and subdomains do appear.

> Incoming A queries are for "ns1.uceb.org" and "ns2.uceb.org". Our
> statistics are on http://as112.nix.cz/cgi-bin/bindgraph.cgi for reference.

We see both A and AAAA (even A6) for {ns1,ns2}.uceb.org.  The majority
of queries, though, asks for 2.0.0.127.blackholes.uceb.org. and then there
are queries for "random" IP addreesses within that BL.  Since our NSD
responds SERVFAIL to queries for unserved zones, we can observe some repeated
queries, as well.

Other AS112 stats (like <http://www.ripe.net/info/stats/ops/as112/nstats_A-monthly.html>)
suggest a similar increase.

> I found, that uceb.org was some spam blacklist in the past, but it isn't
> running now. Last change in the domain was on 12-Jul-2008 according to
> the whois informations.

There is a termination note at
<http://www.anti-abuse.org/rbl-blackholesuceborg-no-longer-online/>
that claims the name servers had loopback addresses.

> I think this is not normal behavior.

No, and it should not be encouraged.  In fact, there is an Internet-Draft
(just that, not approved yet, and I'd not agree with all of its recommendations)
suggesting a less intrusive shutdown strategy for BLs:
<draft-irtf-asrg-bcp-blacklists-03.txt>.  I've also collected some ideas
in <draft-koch-dns-unsolicited-queries-02.txt> (expired).

Maybe we could coordinate some note to the admin contact through either
our Afilias colleagues (since it's an ORG domain) or the OARC secretariat.

-Peter