<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 15.03.25 15:29, Matt Nordhoff wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAKW6eLszMxouYSTCVNZ8P4keGcCrj61_S-LHWjSCNd_vtpjDFw@mail.gmail.com">
<pre wrap="" class="moz-quote-pre">On Sat, Mar 15, 2025 at 11:14 AM Hans Mayer via dns-operations
<a class="moz-txt-link-rfc2396E" href="mailto:dns-operations@dns-oarc.net"><dns-operations@dns-oarc.net></a> wrote:
</pre>
<pre wrap="" class="moz-quote-pre">
The "source" IP has changed a few times but I think it's always within
60.26.0.0/16. Right now it's 60.26.67.97.</pre>
</blockquote>
I don't think it's "right now". It seems there is a pool of such
"services" acting. <br>
I saw on different resolvers different IP addresses, but always the
same IP address for the same DNS server for a certain time interval.
<span style="white-space: pre-wrap">
And from time to time the IP address disappears and a new one comes up.
</span><span style="white-space: pre-wrap">
</span><span style="white-space: pre-wrap">
</span>
<blockquote type="cite"
cite="mid:CAKW6eLszMxouYSTCVNZ8P4keGcCrj61_S-LHWjSCNd_vtpjDFw@mail.gmail.com">
<pre wrap="" class="moz-quote-pre">Since it could be a reflection/amplification attack with spoofed
source addresses, that might be the victim rather than anyone
responsible.
</pre>
</blockquote>
<p>For an attack it comes in too regular intervals, in my opinion. <br>
</p>
<br>
<p><img src="cid:part1.tNcrevmL.NC0ZjL3v@ma.yer.at"
moz-do-not-send="false"></p>
<p>This is the time series for the last 2 weeks for 60.26.0.0/16
with 2 IP addresses involved. <br>
Average is about 122.3 queries in 3 hours. I don't have the
deviation ready to hand. <br>
</p>
<p>// Hans <br>
</p>
<p>-- <br>
</p>
<p><br>
</p>
<br>
</body>
</html>