[dns-operations] nameservers being attacked

Mark Andrews marka at isc.org
Tue Nov 26 02:22:38 UTC 2013


In message <5293FA31.9030204 at dnsbed.com>, Dnsbed Ops writes:
> Hello,
> 
> My nameservers currently have been meeting the attacks.
> All  these queries are against one special domain, from the seemed fake IPs.
> And those eat up the bandwidth quickly since I run the nameservers with 
> hosting servers.
> Can you help? Thanks in advance.

The logs actually look like the queries are from recursive servers
following normal recursion looking at the mixture of flags and that
they are directed at a official server for the zone.

ns6.cloudwebdns.com.	3600	IN	A	116.251.209.248
ns6.cloudwebdns.com.	3600	IN	A	192.208.187.242

I suspect something is trying to detect whether there is nxdomain
redirection occuring by prepend a random string to www.byw.so.

Mark
 
> # vnstat -tr
> 4484 packets sampled in 5 seconds
> Traffic average for eth0
> 
>        rx       300.80 kbit/s           449 packets/s
>        tx       520.00 kbit/s           447 packets/s
> 
> The logs:
> 
> Nov 26 09:24:37 ken named[971]: client 61.220.0.153#56580: query: 
> ckijmewww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 61.155.104.177#32620: query: 
> jxfmeuwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 202.96.209.21#36915: query: 
> xevysjwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 220.187.246.51#21572: query: 
> hxcytwwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 74.125.189.23#39963: query: 
> mgygkqwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 202.101.224.70#31797: query: 
> vudzmkwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 61.164.9.74#40111: query: 
> wqtrkpwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 24.92.226.226#2287: query: 
> ummqqkwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 211.98.70.54#3760: query: 
> gcbkhrwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 202.96.199.133#63510: query: 
> wtuvjdwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 24.92.226.202#2192: query: 
> gocckcwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 24.92.226.213#2280: query: 
> ueycawwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 211.98.70.54#23331: query: 
> izkeezwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 211.98.70.54#44953: query: 
> tflgjvwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 222.172.200.77#17808: query: 
> nbgabcwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 220.187.246.35#6018: query: 
> ywusykwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 61.153.41.132#9017: query: 
> dodmjvwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:37 ken named[971]: client 61.139.113.166#47469: query: 
> yaaiykwww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 119.6.73.228#17004: query: 
> www.499m.com IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 204.13.248.180#39443: query: 
> cmesiswww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.71#45699: query: 
> tewfpfwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#53403: query: 
> wwygcewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.50#51153: query: 
> dkxjkcwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#23850: query: 
> oqyqogwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.70#15115: query: 
> mgyciuwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#4217: query: 
> cceiyowww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#23288: query: 
> qsakkiwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#42517: query: 
> migmcewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#23458: query: 
> iiieaowww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.41.20#41682: query: 
> pleevtwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#20161: query: 
> kiaqmqwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#43751: query: 
> mkamgywww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#61093: query: 
> ucyqyqwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#38046: query: 
> kmewggwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.7.245#62586: query: 
> ATohywwww.byW.So IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#51290: query: 
> kayagawww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#11052: query: 
> mgoeyuwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#10590: query: 
> isieuqwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.34#29181: query: 
> kuigwqwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.155.104.172#32513: query: 
> slxnzbwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#21826: query: 
> lrutxiwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.199.133#33436: query: 
> ccimqiwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.5.244#30591: query: 
> NzatzqwWW.byw.SO IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.199.133#20204: query: 
> uwuoucwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.51#12546: query: 
> auwwoywww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.151.133.162#41030: query: 
> mydfbvwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.51#32118: query: 
> owgkscwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.41.20#52692: query: 
> kmcwucwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.41.16#47151: query: 
> kemyqwwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 67.215.82.11#22666: query: 
> ucdcwjwww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.209.147#65144: query: 
> weeyriwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.16.214#55692: query: 
> ucdcwjwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.123#13633: query: 
> bzqxebwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.54#58523: query: 
> vdxqizwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 204.13.248.182#5726: query: 
> ywdzsvwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.102.224.82#22550: query: 
> nkhoxzwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 24.92.226.228#18645: query: 
> zuvacfwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.140.11.214#39536: query: 
> omagogwww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.173.131#51617: query: 
> gnfnqqwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.173.131#28719: query: 
> meqsegwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.36#18139: query: 
> eiowuewww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.138.245.181#34876: query: 
> ssioyywww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.68#38694: query: 
> miqemswww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 221.232.247.219#16800: query: 
> oqcyumwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.54#35575: query: 
> mkygkswww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.106.101.202#33619: query: 
> ysgkjqwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#16686: query: 
> HyqmDrwwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.137#2253: query: 
> hqzogtwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.155.104.177#26240: query: 
> wiyosewww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.164.9.74#21060: query: 
> oqkugowww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.119#33405: query: 
> uokkeuwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#44802: query: 
> XsvaDtwwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.16.208#58196: query: 
> aoycwswww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.235#9060: query: 
> vxhvmowww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 221.232.247.221#11166: query: 
> ioaimwwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.35#10741: query: 
> sbdwlswww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#63520: query: 
> UwagIiwwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#63871: query: 
> PihzFawwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.62.191.11#11884: query: 
> klxwbswww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 222.178.10.249#33920: query: 
> wpzpquwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.234#13726: query: 
> gjyiiwwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#61603: query: 
> YwoaUcwwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.129.192.29#34827: query: 
> dmbigwwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.155.104.177#9936: query: 
> jstaavwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.154#43441: query: 
> oomkibwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.5.244#27187: query: 
> EVplGfWwW.byw.So IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.235#42475: query: 
> yxbvatwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.140.11.160#49098: query: 
> igmkeiwww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.16.211#61223: query: 
> ebrhhiwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.234#18732: query: 
> crjhkiwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.71#45278: query: 
> vudzmkwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.189.19#38800: query: 
> oocekywww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.41.18#57929: query: 
> ascqwkwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.234#20301: query: 
> rznbuhwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 222.178.10.249#33920: query: 
> xwdkbvwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.209.22#22334: query: 
> csgbspwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.154#23616: query: 
> gajginwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.102.224.82#59465: query: 
> qkcqwiwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.199.133#57768: query: 
> cdqduvwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.70#23384: query: 
> xfwllowww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.51#43968: query: 
> dlpueswww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.71#43987: query: 
> ggsgsewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.54#46208: query: 
> qezlyewww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.191.83#40054: query: 
> xdvfnuwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.199.133#51664: query: 
> csusazwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.173.131#59993: query: 
> aiuieywww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#63496: query: 
> GeccAowwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.54#41241: query: 
> hfeaqzwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.234#41568: query: 
> mqxjlewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#5530: query: 
> XvfjAewwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.139.113.166#47022: query: 
> oomggswww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#19629: query: 
> NclxScwwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.70#20266: query: 
> tewfpfwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.62.191.11#51451: query: 
> mkkuoswww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.234#53594: query: 
> ekekcywww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.159#30103: query: 
> kwwmguwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.16.215#62941: query: 
> wyisakwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#58785: query: 
> BkoiLdwwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.155.104.177#49532: query: 
> weweoewww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.186.208#59926: query: 
> fnahzkwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.54#41794: query: 
> sagimywww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.191.80#51129: query: 
> crwnhqwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.199.133#10217: query: 
> iuekwawww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.199.133#57211: query: 
> qcqokmwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 221.232.247.210#33409: query: 
> keouuawww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.62.191.11#36999: query: 
> kawyaowww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.62.191.11#7851: query: 
> ycfxzwwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.51#54384: query: 
> cvmbxmwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 218.242.122.72#39405: query: 
> xyvewfwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 173.194.99.17#54892: query: 
> skiwqiwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.209.22#21946: query: 
> cccagmwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.50#50715: query: 
> gcmqggwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 204.13.248.182#26175: query: 
> bgcwqvwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.35#35991: query: 
> uccwgswww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.10#23244: query: 
> YwsyYgwwW.byw.So IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.154#46673: query: 
> wvahixwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.129.192.25#49029: query: 
> migogmwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.146#6245: query: 
> wvahixwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.139.113.162#48387: query: 
> aikdpowww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 59.51.78.222#30936: query: 
> gasogywww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.7.245#29740: query: 
> qwiAyiwWW.ByW.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.38#33937: query: 
> yiwackwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.54#45731: query: 
> zcmqagwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.189.22#42261: query: 
> gcisokwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.62.191.11#5635: query: 
> ucmksmwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.186.209#61059: query: 
> lbtvniwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.50#50602: query: 
> gacuywwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.62.191.11#11744: query: 
> ciasuiwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.139.113.166#58187: query: 
> wsoquqwww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.2.146#20515: query: 
> hclhtowww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.187.80#48507: query: 
> iqefjvwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.209.15#29191: query: 
> lclxkzwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.7.245#24644: query: 
> bQtoFvwWW.bYW.sO IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.38#7732: query: 
> uggwowwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.38#1665: query: 
> mwdngowww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.138.245.187#37942: query: 
> gujfsrwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.62.191.11#41578: query: 
> iccmqewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.16.209#59757: query: 
> smgqkpwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.199.133#35988: query: 
> idqsvbwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.164.9.72#20936: query: 
> oqkugowww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.38#26510: query: 
> wnqrjiwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.38#57345: query: 
> hkjgrswww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.70#27244: query: 
> ggsgsewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 204.13.248.180#60547: query: 
> meciwgwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.138.245.181#19821: query: 
> mccoamwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 216.146.38.152#40476: query: 
> ygufprwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.70#27186: query: 
> ougdmdwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.38#58729: query: 
> wdwnqcwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.35#59350: query: 
> ubcvaiwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.173.131#62965: query: 
> pbmrewwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 121.10.40.130#13756: query: 
> wakmywwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.189.20#55886: query: 
> wbcrmjwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.51#45468: query: 
> rpjmegwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.106#3323: query: 
> zdqcsjwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.163#23433: query: 
> ldupstwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 221.120.249.9#22137: query: 
> wbcrmjwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.7.245#30824: query: 
> GyIguwWWW.bYw.So IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.191.84#54199: query: 
> umcsuqwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.146#48758: query: 
> vdfkrmwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.112#61083: query: 
> lfvjtpwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.173.131#36569: query: 
> uscmswwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.139.113.162#47127: query: 
> iqoqmmwww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 110.77.147.66#3981: query: 
> eddjijwww.byw.so IN A -E (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 69.252.250.15#19726: query: 
> kdmxyjwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 216.146.38.157#63185: query: 
> jfnijnwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.186.84#63836: query: 
> ueqmkmwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.121#29232: query: 
> nggxdiwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 76.96.13.141#24214: query: 
> kdmxyjwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.38#34151: query: 
> ayosyewww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 216.146.38.152#26952: query: 
> aykcqqwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.51#11560: query: 
> bjswbtwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 59.51.78.220#49574: query: 
> msiwzbwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.70#27313: query: 
> youoeewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.129.192.29#4883: query: 
> nzisqcwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.51#10340: query: 
> vaiuydwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.138.245.182#21590: query: 
> mmskgiwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.34#25447: query: 
> hzcojiwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.173.130#9972: query: 
> cowwkcwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 218.242.122.72#63276: query: 
> yamrugwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.235#18532: query: 
> cucgicwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.129.192.25#46222: query: 
> qwskakwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.187.81#35076: query: 
> fsmgtmwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.220.0.113#64024: query: 
> aoqokewww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.189.17#53128: query: 
> miiqewwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.209.22#51019: query: 
> kameeawww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.6#51578: query: 
> pihzfawww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.50#36954: query: 
> iasqocwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.34#62023: query: 
> gaqwuewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.7.245#61231: query: 
> CWUGeWwww.Byw.SO IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.199.133#48801: query: 
> sakcwxwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.164.9.72#15641: query: 
> iasicywww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.173.131#58365: query: 
> qgvcamwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.155.104.174#59532: query: 
> gcwguswww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.138.245.182#42728: query: 
> thamrbwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.6#1816: query: 
> ywoaucwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 123.129.192.25#45414: query: 
> ifcefjwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.62.191.11#26553: query: 
> qckciawww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.128.130.228#57165: query: 
> moqhonwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.7.245#64134: query: 
> xslMhdwww.BYW.So IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.235#31169: query: 
> cramdtwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.146#29403: query: 
> qgsqoswww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.96.209.21#17161: query: 
> ogsqsewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 203.113.7.245#24644: query: 
> rXBGMJWWW.Byw.SO IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.173.130#10722: query: 
> ioewuywww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.71#25520: query: 
> gwyeukwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.139.113.162#40807: query: 
> cjnzxewww.byw.so IN A - (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.146#28009: query: 
> qmiuuswww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.6#54962: query: 
> xvfjaewww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 202.101.224.71#56620: query: 
> youoeewww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 59.51.78.222#11484: query: 
> qrtrotwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 61.130.254.235#56009: query: 
> wwsmagwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 211.98.70.146#23638: query: 
> mekkewwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.16.82#38538: query: 
> hplehpwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 220.187.246.35#4746: query: 
> exoejjwww.byw.so IN A -EDC (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 221.120.249.9#25551: query: 
> gwwqscwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 173.194.99.16#35596: query: 
> qgyaecwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 117.135.192.6#10703: query: 
> nclxscwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 74.125.16.208#64697: query: 
> reulzkwww.byw.so IN A -ED (192.208.187.242)
> Nov 26 09:24:38 ken named[971]: client 200.11.153.71#15141: query: 
> iuccgqwww.byw.so IN A -ED (192.208.187.242)
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-jobs mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org



More information about the dns-operations mailing list