<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>Em 26/11/2013, à(s) 00:22, Mark Andrews <<a href="mailto:marka@isc.org">marka@isc.org</a>> escreveu:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br>In message <<a href="mailto:5293FA31.9030204@dnsbed.com">5293FA31.9030204@dnsbed.com</a>>, Dnsbed Ops writes:<br><blockquote type="cite">Hello,<br><br>My nameservers currently have been meeting the attacks.<br>All these queries are against one special domain, from the seemed fake IPs.<br>And those eat up the bandwidth quickly since I run the nameservers with<span class="Apple-converted-space"> </span><br>hosting servers.<br>Can you help? Thanks in advance.<br></blockquote><br>The logs actually look like the queries are from recursive servers<br>following normal recursion looking at the mixture of flags and that<br>they are directed at a official server for the zone.<br><br><a href="http://ns6.cloudwebdns.com/">ns6.cloudwebdns.com</a>.<span class="Apple-tab-span" style="white-space: pre;"> </span>3600<span class="Apple-tab-span" style="white-space: pre;"> </span>IN<span class="Apple-tab-span" style="white-space: pre;"> </span>A<span class="Apple-tab-span" style="white-space: pre;"> </span>116.251.209.248<br><a href="http://ns6.cloudwebdns.com/">ns6.cloudwebdns.com</a>.<span class="Apple-tab-span" style="white-space: pre;"> </span>3600<span class="Apple-tab-span" style="white-space: pre;"> </span>IN<span class="Apple-tab-span" style="white-space: pre;"> </span>A<span class="Apple-tab-span" style="white-space: pre;"> </span>192.208.187.242<br><br>I suspect something is trying to detect whether there is nxdomain<br>redirection occuring by prepend a random string to<span class="Apple-converted-space"> </span><a href="http://www.byw.so/">www.byw.so</a>.<br></div></blockquote></div><br><div><br></div><div>Which follows the known Chromium (main Google Chrome component) pattern of a few random 10-character requests for every search query to make such detection.</div><div><br></div><div><br></div><div>Rubens</div><div><br></div><div><br></div><div><br></div></body></html>