[as112-ops] uceb.org "A" queries on AS112

[Nick Hilliard]

Vesselin Kolev wrote:
> We can confirm the noticed increase of "A" RR queries to 
> blackholes.uceb.org (AS112 node operated by Sofia University; AS path: 
> ... 5421 112).

INEX is also seeing lots of queries - about 40 per second, but peaking up 
to about 150 per second.  As the uceb.org domain has been off-line for a 
while, I would speculate that what's happening is that the last version of 
the blacklist zone file included a wildcard NS record to point to 
blackhole-{1,2}.iana.org, and that this version has now been cached locally 
in a bunch of locations.  Who knows when this will expire??

TBH, I don't see how pointing your pet anti-spam project at someone else's 
DNS servers is any different from theft of service.  The hot-headed part of 
me is howling to add the blackholes.uceb.org zone to the dns config on this 
box and reply with 127.0.0.2 for *.blackholes.uceb.org.  ref:

http://web.archive.org/web/20070810034305/http://www.uceb.org/using.html


Nick
-- 
Network Ability Ltd. | Head of Operations      | Tel: +353 1 6169698
3 Westland Square    | INEX - Internet Neutral | Fax: +353 1 6041981
Dublin 2, Ireland    | Exchange Association    | Email: nick at inex.ie