[dns-operations] DNSimple under attack?

Dnsbed (Jeff) support at dnsbed.com
Fri Dec 12 09:35:13 UTC 2014


My auth-nameservers met many times this kind of attacks.
Sometime they were from google or MS's recursive name servers.
I don't why.

gmail wrote:
> We got the following log from ISP recursive name server in Beijing, 
> the QPS for ISP is closed to 80,000 during the attack.
> From ISP recursive name server log, we got the following query:
> 12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: 
> RLSA7H4P.arkhamnetwork.org <http://RLSA7H4P.arkhamnetwork.org> IN A 
> SERVFAIL + NS NE NT ND NC
> 12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: 
> yvLjEthQ.arkhamnetwork.org <http://yvLjEthQ.arkhamnetwork.org> IN A 
> SERVFAIL + NS NE NT ND NC
> 12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: 
> fykmxdl8.arkhamnetwork.org <http://fykmxdl8.arkhamnetwork.org> IN A 
> SERVFAIL + NS NE NT ND NC
> 12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: 
> h5cCXilV.arkhamnetwork.org <http://h5cCXilV.arkhamnetwork.org> IN A 
> SERVFAIL + NS NE NT ND NC
> 12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: 
> gqf0gVnd.arkhamnetwork.org <http://gqf0gVnd.arkhamnetwork.org> IN A 
> SERVFAIL + NS NE NT ND NC

-- 
Best Regards,
DNSbed Hosting <http://www.dnsbed.com/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20141212/89be5568/attachment.html>


More information about the dns-operations mailing list