<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">We got the following log from ISP recursive name server in Beijing, the QPS for ISP is closed to 80,000 during the attack.</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">From ISP recursive name server log, we got the following query:</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: <a href="http://RLSA7H4P.arkhamnetwork.org">RLSA7H4P.arkhamnetwork.org</a> IN A SERVFAIL + NS NE NT ND NC</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: <a href="http://yvLjEthQ.arkhamnetwork.org">yvLjEthQ.arkhamnetwork.org</a> IN A SERVFAIL + NS NE NT ND NC</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: <a href="http://fykmxdl8.arkhamnetwork.org">fykmxdl8.arkhamnetwork.org</a> IN A SERVFAIL + NS NE NT ND NC</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: <a href="http://h5cCXilV.arkhamnetwork.org">h5cCXilV.arkhamnetwork.org</a> IN A SERVFAIL + NS NE NT ND NC</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">12-Dec-2014 09:42:54.027 client 60.220.197.64 42620: view default: <a href="http://gqf0gVnd.arkhamnetwork.org">gqf0gVnd.arkhamnetwork.org</a> IN A SERVFAIL + NS NE NT ND NC</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">...</div><div style="margin: 0px; font-size: 14px; font-family: Menlo; min-height: 16px;"><br></div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">There is one quite strange behavior of name server for <a href="http://arkhamnetwork.org">arkhamnetwork.org</a>, whose ip is 173.245.58.170</div><div style="margin: 0px; font-size: 14px; font-family: Menlo; min-height: 16px;"><br></div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">dig @173.245.58.170 <a href="http://xxx.arkhamnetwork.org">xxx.arkhamnetwork.org</a></div><div style="margin: 0px; font-size: 14px; font-family: Menlo; min-height: 16px;"><br></div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">;; QUESTION SECTION:</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">;<a href="http://xxx.arkhamnetwork.org">xxx.arkhamnetwork.org</a>. IN A</div><div style="margin: 0px; font-size: 14px; font-family: Menlo; min-height: 16px;"><br></div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">;; ANSWER SECTION:</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;"><a href="http://xxx.arkhamnetwork.org">xxx.arkhamnetwork.org</a>. 300 IN CNAME <a href="http://arkhamnetwork.org">arkhamnetwork.org</a>.</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;"><a href="http://arkhamnetwork.org">arkhamnetwork.org</a>. 300 IN CNAME <a href="http://ovh.arkhamnetwork.org">ovh.arkhamnetwork.org</a>.</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;"><a href="http://ovh.arkhamnetwork.org">ovh.arkhamnetwork.org</a>. 300 IN A 167.114.43.80</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;"><a href="http://ovh.arkhamnetwork.org">ovh.arkhamnetwork.org</a>. 300 IN A 167.114.43.96</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;"><a href="http://ovh.arkhamnetwork.org">ovh.arkhamnetwork.org</a>. 300 IN A 198.50.196.32</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;"><a href="http://ovh.arkhamnetwork.org">ovh.arkhamnetwork.org</a>. 300 IN A 167.114.25.128</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;"><a href="http://ovh.arkhamnetwork.org">ovh.arkhamnetwork.org</a>. 300 IN A 167.114.57.208</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;"><a href="http://ovh.arkhamnetwork.org">ovh.arkhamnetwork.org</a>. 300 IN A 156.154.164.59</div><div style="margin: 0px; font-size: 14px; font-family: Menlo; min-height: 16px;"><br></div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">It looks like there is wildcard catch for meaningless domain, but when dig any </div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">domain name whose first label length equals to 8 just like the attack </div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">traffic, you get: </div><div style="margin: 0px; font-size: 14px; font-family: Menlo; min-height: 16px;"><br></div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">dig @173.245.58.170 <a href="http://xxxxxxxx.arkhamnetwork.org">xxxxxxxx.arkhamnetwork.org</a> </div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">; <<>> DiG 9.8.3-P1 <<>> @173.245.58.170 <a href="http://xxxxxxxx.arkhamnetwork.org">xxxxxxxx.arkhamnetwork.org</a></div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">; (1 server found)</div><div style="margin: 0px; font-size: 14px; font-family: Menlo;">;; global options: +cmd</div><span style="font-family: Menlo; font-size: 14px;">;; connection timed out; no servers could be reached</span><span style="font-family: Menlo; font-size: 14px;"> </span></div><div><br></div><div>T<span style="font-family: Menlo; font-size: 14px;">he name server times out, </span><span style="font-family: Menlo; font-size: 14px;">it cause the recursive name server returns SERVFAIL, </span></div><div><span style="font-family: Menlo; font-size: 14px;">and used up the resource of recursive server. Does anyone know why?</span></div><div><span style="font-family: Menlo; font-size: 14px;"><br></span></div><div><span style="font-family: Menlo; font-size: 14px;">feng </span><div><div><br></div><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 16px;">
<div>
<div>
<div>Would that happen to be <a href="http://arkhamnetwork.com">arkhamnetwork.com</a> or <a href="http://arkhamnetwork.org">arkhamnetwork.org</a>?</div>
<div>
<div><br>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div>
<div>On 12/11/14, 7:50 PM, "Dnsbed (Jeff)" <<a href="mailto:support@dnsbed.com">support@dnsbed.com</a>> wrote:</div>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="border-left-color: rgb(181, 196, 223); border-left-width: 5px; border-left-style: solid; padding: 0px 0px 0px 5px; margin: 0px 0px 0px 5px;" type="cite">
<div>
<div bgcolor="#FFFFFF" text="#000000">DNSMadeEasy, DNSimple, 1AND1 were under attacks these days.<br>
I heard DNSMadeEasy and DNSimple were attacked due to the same domain name hosted there.<br>
<br>
Livingood, Jason wrote:
<blockquote cite="mid:D0AF8A30.EDE67%25jason_livingood@cable.comcast.com" type="cite">
<div>Seems like a lot of DNS abuse happening this week. Surely there’s a wider story someplace?</div>
<div><br>
</div>
<div>Jason</div>
</blockquote>
<br>
<div class="moz-signature">-- <br>
Best Regards,<br>
<a href="http://www.dnsbed.com/">DNSbed Hosting</a><br>
<br>
</div>
</div>
</div>
</blockquote>
</span>
</div>
_______________________________________________<br>dns-operations mailing list<br><a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>dns-jobs mailing list<br>https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</blockquote></div><br></div></body></html>