On 2020/4/2 3:19 下午, Stephane Bortzmeyer wrote: > DNS or another type? Stephane, All the packages were DNS requests, some queries like 'dig domain.com any'. but their IP address seems spoofed. A request from the fake address to our nameserver, but nameserver try its best to reply to this unreal address. Thanks.