<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Thomas and Randy,<div><br></div><div>For what it's worth and from an end-user perspective in this: as a holder of many domains in many tlds, there's a new round of scams / spam where owners of domain.cctld is informed <a href="http://domain.com">domain.com</a> is in pendingDelete/redemptionPeriod/... status, and trying to sell / auction the <a href="http://domain.com">domain.com</a>. (just got one this morning for a .com equivalent to a .be I own)</div><div><br></div><div>"They" are probably building their lists...</div><div><br></div><div>Frank</div><div><div><br><blockquote type="cite"><div>On 13 Jun 2024, at 09:04, Thomas Dupas via dns-operations <dns-operations@dns-oarc.net> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b><br class="Apple-interchange-newline">From:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;">Thomas Dupas <<a href="mailto:thomas.dupas@dnsbelgium.be" style="color: blue; text-decoration: underline;">thomas.dupas@dnsbelgium.be</a>><br></span></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b>Subject:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;"><b>Re: [dns-operations] cctld enumeration attack</b><br></span></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b>Date:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;">13 June 2024 at 09:04:51 CEST<br></span></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b>To:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;">Randy Bush <<a href="mailto:randy@psg.com" style="color: blue; text-decoration: underline;">randy@psg.com</a>><br></span></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b>Cc:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;">DNS Operations <<a href="mailto:dns-operations@dns-oarc.net" style="color: blue; text-decoration: underline;">dns-operations@dns-oarc.net</a>><br></span></div><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">Hi Randy,<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">We saw a strange pattern a few days ago, which we initially thought came from Google resolvers, coming from GCE.<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">A few 10K qps per NS instance.<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">Block lasting ~12 hours, seemingly .com registrations attempted towards our cctld.<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">Br,<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">Thomas<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div id="mail-editor-reference-message-container"><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;"><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: Aptos, sans-serif;"><b><span style="">From:<span class="Apple-converted-space"> </span></span></b><span style="">dns-operations <<a href="mailto:dns-operations-bounces@dns-oarc.net" style="color: blue; text-decoration: underline;">dns-operations-bounces@dns-oarc.net</a>> on behalf of Randy Bush <<a href="mailto:randy@psg.com" style="color: blue; text-decoration: underline;">randy@psg.com</a>><br><b>Date:<span class="Apple-converted-space"> </span></b>Wednesday, 12 June 2024 at 18:34<br><b>To:<span class="Apple-converted-space"> </span></b>DNS Operations <<a href="mailto:dns-operations@dns-oarc.net" style="color: blue; text-decoration: underline;">dns-operations@dns-oarc.net</a>><br><b>Subject:<span class="Apple-converted-space"> </span></b>[dns-operations] cctld enumeration attack<o:p></o:p></span></p></div><div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">[Sommige personen die dit bericht ontvangen, ontvangen vaak geen e-mail van<span class="Apple-converted-space"> </span><a href="mailto:randy@psg.com" style="color: blue; text-decoration: underline;">randy@psg.com</a>. Informatie over waarom dit belangrijk is op<span class="Apple-converted-space"> </span><a href="https://aka.ms/LearnAboutSenderIdentification%5d" style="color: blue; text-decoration: underline;">https://aka.ms/LearnAboutSenderIdentification]</a><br><br>anyone else seeing somewhat serious distributed cctld enumeration<br>attempts?<br><br>randy<br>_______________________________________________<br>dns-operations mailing list<br><a href="mailto:dns-operations@lists.dns-oarc.net" style="color: blue; text-decoration: underline;">dns-operations@lists.dns-oarc.net</a><br><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" style="color: blue; text-decoration: underline;">https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.dns-oarc.net%2Fmailman%2Flistinfo%2Fdns-operations&data=05%7C02%7Cthomas.dupas%40dnsbelgium.be%7C76bd003a0eef431d351308dc8afd8aae%7C695195dec0cb447892042a861e60e59c%7C0%7C0%7C638538068766321960%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=uSGMrDl30DWQyOssYgHswQDoWsw4GdvHJJGrvB8eYCU%3D&reserved=0</a><o:p></o:p></span></div></div></div></div></div><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">dns-operations mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="mailto:dns-operations@lists.dns-oarc.net" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">dns-operations@lists.dns-oarc.net</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a></div></blockquote></div><br></div></body></html>