
<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div>Or bad guys posing as good guys. You need to check "evil bit" (<a href="http://www.ietf.org/rfc/rfc3514.txt">http://www.ietf.org/rfc/rfc3514.txt</a>) to figure out which one. <div><br></div><div><br></div><div>Rubens</div><div><br></div><div><br><div><div>Em 18/09/2012, às 21:25, Mohamed Lrhazi escreveu:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Great, thanks a lot guys. So this is most likely good guys, not bad<br>guys as one would suspect at firs!<br><br>Mohamed.<br><br>On Tue, Sep 18, 2012 at 8:14 PM, David Miller <<a href="mailto:dmiller@tiggee.com">dmiller@tiggee.com</a>> wrote:<br><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">On 9/18/2012 8:06 PM, Mohamed Lrhazi wrote:<br></blockquote><blockquote type="cite"><blockquote type="cite">I've noticed quite a bit of queries to our DNS servers, that look<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">pretty normal except for the fact that the character case is weird..<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">seems to be switching case randomly!<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">like:<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><a href="http://nAme1.dOMain.Com">nAme1.dOMain.Com</a><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><a href="http://naMe2.DOMain.coM">naMe2.DOMain.coM</a><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">...<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">and so on..<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">I am wondering if this my DNS server logging issue, or some bug or<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">attack/scan technique out there.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Probably just 0x20 bit encoding.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Refs:<br></blockquote><blockquote type="cite"><a href="https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00">https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00</a><br></blockquote><blockquote type="cite"><a href="https://isc.sans.edu/diary.html?storyid=12418">https://isc.sans.edu/diary.html?storyid=12418</a><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">-DMM<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">Thanks,<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Mohamed.<br></blockquote></blockquote>_______________________________________________<br>dns-operations mailing list<br><a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>dns-jobs mailing list<br>https://lists.dns-oarc.net/mailman/listinfo/dns-jobs<br></div></blockquote></div><br></div></body></html>