Full Disclosure mailing list archives
Re: FW: Question for DNS pros
From: Frank Knobbe <frank () knobbe us>
Date: Tue, 03 Aug 2004 18:20:52 -0500
On Tue, 2004-08-03 at 17:52, Frank Knobbe wrote:
216.154.239.240 - SBC in Irvine
--> couldn't confirm that one
66.150.165.7 - Logical US-AWS NAP through Internap
--> seadns01.shopattwireless.com (match)
64.170.177.10 - SBC Interactive through PacBell
--> 64-170-177-10.ptim.com (match)
63.240.26.10 - CERFnet
--> ny-ns.marketwatch.com (match)
63.210.252.135 - Level 3
--> cindns01.shopattwireless.com (match) (match means it is the exact same traffic, just a low volume, between 3 and 10 packets total). It appears all these are DNS servers. They also all respond to queries for "." with the list of root servers. That means that they are recursive. Perhaps there is a 0-day exploit for certain DNS servers? Maybe those DNS servers have a worm that is trying to spread? Maybe seeded from China? Otherwise, why would AT&T's name server be sending out probes? The mystery deepens... Regards, Frank
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Re: FW: Question for DNS pros Frank Knobbe (Aug 03)
- Re: FW: Question for DNS pros Paul Schmehl (Aug 03)
- Re: FW: Question for DNS pros Ron DuFresne (Aug 03)
- Re: FW: Question for DNS pros Frank Knobbe (Aug 03)
- Re: FW: Question for DNS pros Ron DuFresne (Aug 03)
- Re: FW: Question for DNS pros Ron DuFresne (Aug 03)
- Re: FW: Question for DNS pros Frank Knobbe (Aug 03)
- Re: FW: Question for DNS pros Mark (Aug 03)
- Re: FW: Question for DNS pros Frank Knobbe (Aug 03)
- Re: FW: Question for DNS pros Frank Knobbe (Aug 03)
- Re: FW: Question for DNS pros Paul Schmehl (Aug 03)
- Re: FW: Question for DNS pros Frank Knobbe (Aug 03)
- Re: FW: Question for DNS pros grutz (Aug 03)