nanog mailing list archives
Re: isprime DOS in progress
From: Brian Keefer <chort () smtps net>
Date: Sat, 24 Jan 2009 11:03:57 -0800
On Jan 23, 2009, at 12:20 PM, Luke Sheldrick wrote:
Looks to me like the target has moved, anyone else seeing similar?
It's switched again. The new target is 206.71.158.30 .Over night it cycled through several different IPs (testing the waters?), and finally started on this one around 10:26 Pacific time this morning.
Timeline below. -- bkJan 23 23:24:47 imhotep named[32762]: client 63.217.28.226#53: view ext: query (cache) './NS/IN' denied Jan 24 00:51:11 imhotep named[32762]: client 208.78.169.236#33027: view ext: query (cache) './NS/IN' denied
Jan 24 00:51:11 imhotep last message repeated 2 timesJan 24 00:51:11 imhotep named[32762]: client 204.11.51.60#32831: view ext: query (cache) './NS/IN' denied
Jan 24 00:51:11 imhotep last message repeated 2 timesJan 24 00:51:30 imhotep named[32762]: client 208.37.177.61#42517: view ext: query (cache) './NS/IN' denied
Jan 24 00:51:30 imhotep last message repeated 2 timesJan 24 01:54:44 imhotep named[32762]: client 208.37.177.61#42517: view ext: query (cache) './NS/IN' denied
Jan 24 01:54:44 imhotep last message repeated 2 timesJan 24 01:55:44 imhotep named[32762]: client 204.11.51.60#32831: view ext: query (cache) './NS/IN' denied
Jan 24 01:55:44 imhotep last message repeated 2 timesJan 24 01:57:46 imhotep named[32762]: client 208.78.169.235#46265: view ext: query (cache) './NS/IN' denied
Jan 24 01:57:46 imhotep last message repeated 2 timesJan 24 02:58:29 imhotep named[32762]: client 208.37.177.62#46265: view ext: query (cache) './NS/IN' denied
Jan 24 02:58:30 imhotep last message repeated 2 timesJan 24 03:00:34 imhotep named[32762]: client 204.11.51.60#32831: view ext: query (cache) './NS/IN' denied
Jan 24 03:00:35 imhotep last message repeated 2 timesJan 24 03:05:05 imhotep named[32762]: client 208.78.169.236#33027: view ext: query (cache) './NS/IN' denied
Jan 24 03:05:05 imhotep last message repeated 2 timesJan 24 03:07:49 imhotep named[32762]: client 63.217.28.226#53: view ext: query (cache) './NS/IN' denied Jan 24 04:02:38 imhotep named[32762]: client 208.37.177.61#42517: view ext: query (cache) './NS/IN' denied
Jan 24 04:02:38 imhotep last message repeated 2 timesJan 24 04:05:43 imhotep named[32762]: client 204.11.51.59#32802: view ext: query (cache) './NS/IN' denied
Jan 24 04:05:43 imhotep last message repeated 2 timesJan 24 04:12:52 imhotep named[32762]: client 208.78.169.234#42517: view ext: query (cache) './NS/IN' denied
Jan 24 04:12:52 imhotep last message repeated 2 timesJan 24 05:07:37 imhotep named[32762]: client 208.37.177.61#42517: view ext: query (cache) './NS/IN' denied
Jan 24 05:07:37 imhotep last message repeated 2 timesJan 24 05:11:35 imhotep named[32762]: client 204.11.51.59#32802: view ext: query (cache) './NS/IN' denied
Jan 24 05:11:35 imhotep last message repeated 2 timesJan 24 05:21:36 imhotep named[32762]: client 208.78.169.234#42517: view ext: query (cache) './NS/IN' denied
Jan 24 05:21:37 imhotep last message repeated 2 timesJan 24 06:16:06 imhotep named[32762]: client 208.37.177.62#46265: view ext: query (cache) './NS/IN' denied
Jan 24 06:16:06 imhotep last message repeated 2 timesJan 24 06:20:19 imhotep named[32762]: client 204.11.51.61#43329: view ext: query (cache) './NS/IN' denied
Jan 24 06:20:19 imhotep last message repeated 2 timesJan 24 06:29:37 imhotep named[32762]: client 208.78.169.235#46265: view ext: query (cache) './NS/IN' denied
Jan 24 06:29:37 imhotep last message repeated 2 timesJan 24 06:35:11 imhotep named[32762]: client 149.20.52.161#61452: view ext: notify question section contains no SOA Jan 24 07:23:06 imhotep named[32762]: client 208.37.177.61#42517: view ext: query (cache) './NS/IN' denied
Jan 24 07:23:06 imhotep last message repeated 2 timesJan 24 07:28:27 imhotep named[32762]: client 204.11.51.60#32831: view ext: query (cache) './NS/IN' denied
Jan 24 07:28:27 imhotep last message repeated 2 timesJan 24 07:40:25 imhotep named[32762]: client 208.78.169.234#42517: view ext: query (cache) './NS/IN' denied
Jan 24 07:40:25 imhotep last message repeated 2 timesJan 24 08:29:57 imhotep named[32762]: client 208.37.177.61#42517: view ext: query (cache) './NS/IN' denied
Jan 24 08:29:57 imhotep last message repeated 2 timesJan 24 08:36:10 imhotep named[32762]: client 204.11.51.61#43330: view ext: query (cache) './NS/IN' denied
Jan 24 08:36:11 imhotep last message repeated 2 timesJan 24 08:52:45 imhotep named[32762]: client 208.78.169.235#46265: view ext: query (cache) './NS/IN' denied
Jan 24 08:52:45 imhotep last message repeated 2 timesJan 24 08:55:54 imhotep named[32762]: client 149.20.58.131#59151: view ext: query (cache) 'localhost/A/IN' denied Jan 24 09:36:38 imhotep named[32762]: client 208.37.177.62#46265: view ext: query (cache) './NS/IN' denied
Jan 24 09:36:38 imhotep last message repeated 2 timesJan 24 09:43:53 imhotep named[32762]: client 204.11.51.61#43330: view ext: query (cache) './NS/IN' denied
Jan 24 09:43:54 imhotep last message repeated 2 timesJan 24 09:53:56 imhotep named[32762]: client 63.217.28.226#53: view ext: query (cache) './NS/IN' denied Jan 24 10:05:28 imhotep named[32762]: client 208.78.169.234#42517: view ext: query (cache) './NS/IN' denied
Jan 24 10:05:28 imhotep last message repeated 2 timesJan 24 10:26:09 imhotep named[32762]: client 206.71.158.30#18971: view ext: query (cache) './NS/IN' denied Jan 24 10:26:11 imhotep named[32762]: client 206.71.158.30#47622: view ext: query (cache) './NS/IN' denied Jan 24 10:26:13 imhotep named[32762]: client 206.71.158.30#16077: view ext: query (cache) './NS/IN' denied
Current thread:
- Re: Are we really this helpless? (Re: isprime DOS in progress), (continued)
- Re: Are we really this helpless? (Re: isprime DOS in progress) David Conrad (Jan 25)
- Re: Are we really this helpless? (Re: isprime DOS in progress) Jon Kibler (Jan 24)
- Re: Are we really this helpless? (Re: isprime DOS in progress) Michael Dillon (Jan 24)
- Re: Are we really this helpless? (Re: isprime DOS in progress) Eugeniu Patrascu (Jan 25)
- Re: Are we really this helpless? (Re: isprime DOS in progress) Eugeniu Patrascu (Jan 25)
- Re: Are we really this helpless? (Re: isprime DOS in progress) Brandon Galbraith (Jan 23)
- Re: Are we really this helpless? (Re: isprime DOS in progress) J.D. Falk (Jan 24)
- Re: Are we really this helpless? (Re: isprime DOS in progress) Seth Mattinen (Jan 24)
- RE: Are we really this helpless? (Re: isprime DOS in progress) Frank Bulk (Jan 23)
- Re: isprime DOS in progress Brian Keefer (Jan 23)
- Re: isprime DOS in progress Brian Keefer (Jan 24)
- Tracking the DNS amplification attacks (was: isprime DOS in progress) Brian Keefer (Jan 24)
- RE: Tracking the DNS amplification attacks (was: isprime DOS in progress) Frank Bulk (Jan 24)
- Re: Tracking the DNS amplification attacks (was: isprime DOS in progress) Brian Keefer (Jan 25)
- Re: Tracking the DNS amplification attacks (was: isprime DOS in progress) James Hess (Jan 25)
- Re: Tracking the DNS amplification attacks (was: isprime DOS in progress) Brian Keefer (Jan 27)
- Re: Tracking the DNS amplification attacks (was: isprime DOS in progress) Brian Keefer (Jan 27)
- Re: Tracking the DNS amplification attacks (was: isprime DOS inprogress) Xaver Aerni (Jan 27)
- Re: Tracking the DNS amplification attacks (was: isprime DOS in progress) Crist Clark (Jan 30)
- Re: isprime DOS in progress Andrew Fried (Jan 24)
- Re: isprime DOS in progress Nathan Ollerenshaw (Jan 23)