[dns-operations] DDoS attack data collection
chort at smtps.net
Fri Jan 30 08:34:56 UTC 2009
I stopped seeing probes for these IPs January 28th between 5AM and 6AM
Up until that time, I had been seeing 2-3 of those IPs per hour (never
more than 3 in a single hour, which is interesting) making queries
for ./IN/NS . They have been silent ever since the 28th.
On Jan 29, 2009, at 6:50 AM, Brian Keefer wrote:
> There are 3 more IPs that started between 2AM and 3AM Pacific:
> On Jan 28, 2009, at 8:52 AM, Duane Wessels wrote:
>> On Wed, 28 Jan 2009, Brian Keefer wrote:
>>> There are two new IPs as of this morning between 3AM and 4AM
>> Thanks. I've updated the script on our web site as well.
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
More information about the dns-operations