[dns-operations] Weird query name "case" queries?

[Mark Andrews]

In message <CAEU_gmf1ARB8khnCxODQRknO1g-Yr0CKWZxSoMAfUyHKtqk4-w at mail.gmail.com>
, Mohamed Lrhazi writes:
> I've noticed quite a bit of queries to our DNS servers, that look
> pretty normal except for the fact that the character case is weird..
> seems to be switching case randomly!

http://courses.isi.jhu.edu/netsec/papers/increased_dns_resistance.pdf

> 
> like:
> 
> nAme1.dOMain.Com
> naMe2.DOMain.coM
> ...
> 
> and so on..
> 
> I am wondering if this my DNS server logging issue, or some bug or
> attack/scan technique out there.
> 
> Thanks,
> Mohamed.
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-jobs mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org