[dns-operations] Queries for isc.org/ANY/IN

[sthaug at nethelp.no]

> > There are the Top 10 clients for this query in the last 24 hours:
> 
> If it is (and it probably is) a DoS attack by amplification (the reply
> to "isc.org ANY +dnssec" is large), then the source IP address is
> forged. It is the address of the victim, not of the attacker.

As mentioned this has been going on for quite a while now. We also see
large amounts of queries for ripe.net/ANY/IN, which also produces a
significant amplification.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no