[dns-operations] nameservers being attacked

Tue Nov 26 09:11:47 UTC 2013

On Mon, Nov 25, 2013 at 6:22 PM, Mark Andrews <marka at isc.org> wrote:

>  In message <5293FA31.9030204 at dnsbed.com>, Dnsbed Ops writes:
> > My nameservers currently have been meeting the attacks.
> > All  these queries are against one special domain, from the seemed fake
> IPs.
> > And those eat up the bandwidth quickly since I run the nameservers with
> > hosting servers.
> > Can you help? Thanks in advance.
>
> The logs actually look like the queries are from recursive servers
> following normal recursion looking at the mixture of flags and that
> they are directed at a official server for the zone.
>
> ns6.cloudwebdns.com.    3600    IN      A       116.251.209.248
> ns6.cloudwebdns.com.    3600    IN      A       192.208.187.242
>

I saw some Google IPs in the logs, and confirmed our requests are triggered
by user requests via our free public DNS servers (8.8.8.8).

I suspect something is trying to detect whether there is nxdomain
> redirection occuring by prepend a random string to www.byw.so.

This started quite suddenly, which excludes a client-side binary change.
 Could be something baked into the javascript of the website, though....

> # vnstat -tr
> > 4484 packets sampled in 5 seconds
> > Traffic average for eth0
> >
> >        rx       300.80 kbit/s           449 packets/s
> >        tx       520.00 kbit/s           447 packets/s
>

That rate is very low, which makes it somewhat unlikely this is an
intentional DoS (which would be 1000 times larger even for a weak attack).
 I'm guessing this is either accidental or is the result of bad javascript
on a website.  Tracking down the source seems difficult, but I'd be
interested in hearing what you find (and how you figured it out!).

Damian

> The logs:
> >
> > Nov 26 09:24:37 ken named[971]: client 61.220.0.153#56580: query:
> > ckijmewww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 61.155.104.177#32620: query:
> > jxfmeuwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 202.96.209.21#36915: query:
> > xevysjwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 220.187.246.51#21572: query:
> > hxcytwwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 74.125.189.23#39963: query:
> > mgygkqwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 202.101.224.70#31797: query:
> > vudzmkwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 61.164.9.74#40111: query:
> > wqtrkpwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 24.92.226.226#2287: query:
> > ummqqkwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 211.98.70.54#3760: query:
> > gcbkhrwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 202.96.199.133#63510: query:
> > wtuvjdwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 24.92.226.202#2192: query:
> > gocckcwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 24.92.226.213#2280: query:
> > ueycawwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 211.98.70.54#23331: query:
> > izkeezwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 211.98.70.54#44953: query:
> > tflgjvwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 222.172.200.77#17808: query:
> > nbgabcwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 220.187.246.35#6018: query:
> > ywusykwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 61.153.41.132#9017: query:
> > dodmjvwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:37 ken named[971]: client 61.139.113.166#47469: query:
> > yaaiykwww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 119.6.73.228#17004: query:
> > www.499m.com IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 204.13.248.180#39443: query:
> > cmesiswww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.71#45699: query:
> > tewfpfwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#53403: query:
> > wwygcewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.50#51153: query:
> > dkxjkcwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#23850: query:
> > oqyqogwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.70#15115: query:
> > mgyciuwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#4217: query:
> > cceiyowww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#23288: query:
> > qsakkiwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#42517: query:
> > migmcewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#23458: query:
> > iiieaowww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.41.20#41682: query:
> > pleevtwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#20161: query:
> > kiaqmqwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#43751: query:
> > mkamgywww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#61093: query:
> > ucyqyqwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#38046: query:
> > kmewggwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.7.245#62586: query:
> > ATohywwww.byW.So IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#51290: query:
> > kayagawww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#11052: query:
> > mgoeyuwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#10590: query:
> > isieuqwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.34#29181: query:
> > kuigwqwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.155.104.172#32513: query:
> > slxnzbwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#21826: query:
> > lrutxiwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.199.133#33436: query:
> > ccimqiwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.5.244#30591: query:
> > NzatzqwWW.byw.SO IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.199.133#20204: query:
> > uwuoucwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.51#12546: query:
> > auwwoywww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.151.133.162#41030: query:
> > mydfbvwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.51#32118: query:
> > owgkscwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.41.20#52692: query:
> > kmcwucwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.41.16#47151: query:
> > kemyqwwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 67.215.82.11#22666: query:
> > ucdcwjwww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.209.147#65144: query:
> > weeyriwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.16.214#55692: query:
> > ucdcwjwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.123#13633: query:
> > bzqxebwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.54#58523: query:
> > vdxqizwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 204.13.248.182#5726: query:
> > ywdzsvwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.102.224.82#22550: query:
> > nkhoxzwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 24.92.226.228#18645: query:
> > zuvacfwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.140.11.214#39536: query:
> > omagogwww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.173.131#51617: query:
> > gnfnqqwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.173.131#28719: query:
> > meqsegwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.36#18139: query:
> > eiowuewww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.138.245.181#34876: query:
> > ssioyywww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.68#38694: query:
> > miqemswww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 221.232.247.219#16800: query:
> > oqcyumwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.54#35575: query:
> > mkygkswww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.106.101.202#33619: query:
> > ysgkjqwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#16686: query:
> > HyqmDrwwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.137#2253: query:
> > hqzogtwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.155.104.177#26240: query:
> > wiyosewww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.164.9.74#21060: query:
> > oqkugowww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.119#33405: query:
> > uokkeuwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#44802: query:
> > XsvaDtwwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.16.208#58196: query:
> > aoycwswww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.235#9060: query:
> > vxhvmowww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 221.232.247.221#11166: query:
> > ioaimwwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.35#10741: query:
> > sbdwlswww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#63520: query:
> > UwagIiwwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#63871: query:
> > PihzFawwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.62.191.11#11884: query:
> > klxwbswww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 222.178.10.249#33920: query:
> > wpzpquwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.234#13726: query:
> > gjyiiwwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#61603: query:
> > YwoaUcwwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.129.192.29#34827: query:
> > dmbigwwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.155.104.177#9936: query:
> > jstaavwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.154#43441: query:
> > oomkibwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.5.244#27187: query:
> > EVplGfWwW.byw.So IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.235#42475: query:
> > yxbvatwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.140.11.160#49098: query:
> > igmkeiwww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.16.211#61223: query:
> > ebrhhiwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.234#18732: query:
> > crjhkiwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.71#45278: query:
> > vudzmkwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.189.19#38800: query:
> > oocekywww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.41.18#57929: query:
> > ascqwkwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.234#20301: query:
> > rznbuhwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 222.178.10.249#33920: query:
> > xwdkbvwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.209.22#22334: query:
> > csgbspwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.154#23616: query:
> > gajginwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.102.224.82#59465: query:
> > qkcqwiwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.199.133#57768: query:
> > cdqduvwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.70#23384: query:
> > xfwllowww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.51#43968: query:
> > dlpueswww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.71#43987: query:
> > ggsgsewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.54#46208: query:
> > qezlyewww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.191.83#40054: query:
> > xdvfnuwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.199.133#51664: query:
> > csusazwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.173.131#59993: query:
> > aiuieywww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#63496: query:
> > GeccAowwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.54#41241: query:
> > hfeaqzwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.234#41568: query:
> > mqxjlewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#5530: query:
> > XvfjAewwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.139.113.166#47022: query:
> > oomggswww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#19629: query:
> > NclxScwwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.70#20266: query:
> > tewfpfwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.62.191.11#51451: query:
> > mkkuoswww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.234#53594: query:
> > ekekcywww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.159#30103: query:
> > kwwmguwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.16.215#62941: query:
> > wyisakwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#58785: query:
> > BkoiLdwwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.155.104.177#49532: query:
> > weweoewww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.186.208#59926: query:
> > fnahzkwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.54#41794: query:
> > sagimywww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.191.80#51129: query:
> > crwnhqwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.199.133#10217: query:
> > iuekwawww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.199.133#57211: query:
> > qcqokmwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 221.232.247.210#33409: query:
> > keouuawww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.62.191.11#36999: query:
> > kawyaowww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.62.191.11#7851: query:
> > ycfxzwwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.51#54384: query:
> > cvmbxmwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 218.242.122.72#39405: query:
> > xyvewfwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 173.194.99.17#54892: query:
> > skiwqiwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.209.22#21946: query:
> > cccagmwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.50#50715: query:
> > gcmqggwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 204.13.248.182#26175: query:
> > bgcwqvwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.35#35991: query:
> > uccwgswww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.10#23244: query:
> > YwsyYgwwW.byw.So IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.154#46673: query:
> > wvahixwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.129.192.25#49029: query:
> > migogmwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.146#6245: query:
> > wvahixwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.139.113.162#48387: query:
> > aikdpowww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 59.51.78.222#30936: query:
> > gasogywww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.7.245#29740: query:
> > qwiAyiwWW.ByW.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.38#33937: query:
> > yiwackwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.54#45731: query:
> > zcmqagwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.189.22#42261: query:
> > gcisokwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.62.191.11#5635: query:
> > ucmksmwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.186.209#61059: query:
> > lbtvniwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.50#50602: query:
> > gacuywwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.62.191.11#11744: query:
> > ciasuiwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.139.113.166#58187: query:
> > wsoquqwww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.2.146#20515: query:
> > hclhtowww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.187.80#48507: query:
> > iqefjvwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.209.15#29191: query:
> > lclxkzwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.7.245#24644: query:
> > bQtoFvwWW.bYW.sO IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.38#7732: query:
> > uggwowwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.38#1665: query:
> > mwdngowww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.138.245.187#37942: query:
> > gujfsrwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.62.191.11#41578: query:
> > iccmqewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.16.209#59757: query:
> > smgqkpwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.199.133#35988: query:
> > idqsvbwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.164.9.72#20936: query:
> > oqkugowww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.38#26510: query:
> > wnqrjiwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.38#57345: query:
> > hkjgrswww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.70#27244: query:
> > ggsgsewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 204.13.248.180#60547: query:
> > meciwgwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.138.245.181#19821: query:
> > mccoamwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 216.146.38.152#40476: query:
> > ygufprwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.70#27186: query:
> > ougdmdwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.38#58729: query:
> > wdwnqcwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.35#59350: query:
> > ubcvaiwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.173.131#62965: query:
> > pbmrewwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 121.10.40.130#13756: query:
> > wakmywwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.189.20#55886: query:
> > wbcrmjwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.51#45468: query:
> > rpjmegwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.106#3323: query:
> > zdqcsjwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.163#23433: query:
> > ldupstwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 221.120.249.9#22137: query:
> > wbcrmjwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.7.245#30824: query:
> > GyIguwWWW.bYw.So IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.191.84#54199: query:
> > umcsuqwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.146#48758: query:
> > vdfkrmwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.112#61083: query:
> > lfvjtpwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.173.131#36569: query:
> > uscmswwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.139.113.162#47127: query:
> > iqoqmmwww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 110.77.147.66#3981: query:
> > eddjijwww.byw.so IN A -E (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 69.252.250.15#19726: query:
> > kdmxyjwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 216.146.38.157#63185: query:
> > jfnijnwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.186.84#63836: query:
> > ueqmkmwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.121#29232: query:
> > nggxdiwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 76.96.13.141#24214: query:
> > kdmxyjwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.38#34151: query:
> > ayosyewww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 216.146.38.152#26952: query:
> > aykcqqwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.51#11560: query:
> > bjswbtwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 59.51.78.220#49574: query:
> > msiwzbwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.70#27313: query:
> > youoeewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.129.192.29#4883: query:
> > nzisqcwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.51#10340: query:
> > vaiuydwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.138.245.182#21590: query:
> > mmskgiwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.34#25447: query:
> > hzcojiwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.173.130#9972: query:
> > cowwkcwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 218.242.122.72#63276: query:
> > yamrugwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.235#18532: query:
> > cucgicwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.129.192.25#46222: query:
> > qwskakwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.187.81#35076: query:
> > fsmgtmwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.220.0.113#64024: query:
> > aoqokewww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.189.17#53128: query:
> > miiqewwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.209.22#51019: query:
> > kameeawww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.6#51578: query:
> > pihzfawww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.50#36954: query:
> > iasqocwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.34#62023: query:
> > gaqwuewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.7.245#61231: query:
> > CWUGeWwww.Byw.SO IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.199.133#48801: query:
> > sakcwxwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.164.9.72#15641: query:
> > iasicywww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.173.131#58365: query:
> > qgvcamwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.155.104.174#59532: query:
> > gcwguswww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.138.245.182#42728: query:
> > thamrbwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.6#1816: query:
> > ywoaucwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 123.129.192.25#45414: query:
> > ifcefjwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.62.191.11#26553: query:
> > qckciawww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.128.130.228#57165: query:
> > moqhonwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.7.245#64134: query:
> > xslMhdwww.BYW.So IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.235#31169: query:
> > cramdtwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.146#29403: query:
> > qgsqoswww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.96.209.21#17161: query:
> > ogsqsewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 203.113.7.245#24644: query:
> > rXBGMJWWW.Byw.SO IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.173.130#10722: query:
> > ioewuywww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.71#25520: query:
> > gwyeukwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.139.113.162#40807: query:
> > cjnzxewww.byw.so IN A - (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.146#28009: query:
> > qmiuuswww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.6#54962: query:
> > xvfjaewww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 202.101.224.71#56620: query:
> > youoeewww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 59.51.78.222#11484: query:
> > qrtrotwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 61.130.254.235#56009: query:
> > wwsmagwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 211.98.70.146#23638: query:
> > mekkewwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.16.82#38538: query:
> > hplehpwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 220.187.246.35#4746: query:
> > exoejjwww.byw.so IN A -EDC (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 221.120.249.9#25551: query:
> > gwwqscwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 173.194.99.16#35596: query:
> > qgyaecwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 117.135.192.6#10703: query:
> > nclxscwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 74.125.16.208#64697: query:
> > reulzkwww.byw.so IN A -ED (192.208.187.242)
> > Nov 26 09:24:38 ken named[971]: client 200.11.153.71#15141: query:
> > iuccgqwww.byw.so IN A -ED (192.208.187.242)
> > _______________________________________________
> > dns-operations mailing list
> > dns-operations at lists.dns-oarc.net
> > https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> > dns-jobs mailing list
> > https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-jobs mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20131126/ee262747/attachment.html>