massive unapproved AXFR's and odd rcvd NOTIFY's

[paul () XTDNET NL (Paul Wouters)]

(All strings "domainname.com" are real domainnames)

I am seeing a LOT of these, even right now:

Feb  9 08:35:59 duplo named[543]: unapproved AXFR from [216.0.52.138].1041 for
"domainname.com" (acl)

1) It doesn't seem to be walking a tld tree, because I see them for .nl, .com, .net etc.
2) I see these even for some domains that only have DNS setup, but don't yet have
   registered domain names. How did they get this information?

On top of that, I'm receiving a lot of these:

Feb  9 08:36:00 duplo named[543]: rcvd NOTIFY(domainname.com, IN, SOA) from [216.0.52.138].1024
Feb  9 08:36:00 duplo named[543]: NOTIFY(SOA) from non-master server (zone domainname.com), from [216.0.52.138].1024

Note that 216.0.52.138 is not a master for ANY of the slave zones I run, yet for some it seems to fake
bind into thinking it is a master zone. (Actually, it is some redhat 6.0 machine according to its login
banner:)

Running named 8.2.2-P3

Paul Wouters
Xtended Internet

--
Broerdijk 27                    Postbus 170             Tel: 31-24-360 39 19    
6523 GM Nijmegen                6500 AD Nijmegen        Fax: 31-24-360 19 99
The Netherlands                 The Netherlands         info () xtdnet nl