RE: DNS all records requests

["matt donovan" <gothicnight2002 () msn com>]

it seems like someone is trying to take the domain over. but it's awefully 
hard if the domain is locked.


> From: Glenn English <ghe () slsware com>
> To: security basics <security-basics () securityfocus com>
> Subject: DNS all records requests
> Date: Tue, 23 May 2006 18:54:22 -0600
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> According to the PIX, for the past few weeks (on every day except
> Mondays) I've been getting "DNS all records requests" from a few IPs.
> And it looks like these requests always immediately triggered another
> all records request from my server to another IP. I don't know any of
> the addresses, and they come in frequently (with hour gaps from time to
> time) at random-ish times. There are 50 or so from one IP, then change
> to another with very little overlap. And chkrootkit doesn't see anything
> odd.
>
> Can anyone tell me what might be going on?
>
> - --
> Glenn English
> ghe () slsware com
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFEc66804yQfZbbTLYRAryeAJsENQ8bx9XMhLZPmgjN/vKSvSUalACeJEb+
> Fl0l4FKb5eVW2U5dWvcQtKE=
> =rcKD
> -----END PGP SIGNATURE-----