[dns-operations] Increasing MX scans

[Antoin Verschuren]

Hi all,

Here at SIDN, we see an increasing load of MX incidents in the last
month. So far we've had 3 "attacks" in January alone, the last one was
yesterday.

I've done some interesting analysis of the source of these queries, and
see a shifting travel pattern of the botnets involved.

My question is if the other 6 major TLD's also see these attacks, f.e.
the one from yesterday, and perhaps want to discuss it in Atlanta.

If there is some consensus I might be able to draft some presentation on
this, though I'm not sure to which audience I should present it.


Antoin Verschuren

Technical Policy Advisor
SIDN
Utrechtseweg 310
PO Box 5022
6802 EA Arnhem
The Netherlands

T +31 26 3525500
F +31 26 3525505
M +31 6 23368970
E antoin.verschuren at sidn.nl
W http://www.sidn.nl/