[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dns-operations
Subject:    [dns-operations] Someone on this list doing some empty non-terminal testing?
From:       David C Lawrence <tale () akamai ! com>
Date:       2017-03-02 21:07:43
Message-ID: 22712.35231.534495.429076 () tale ! kendall ! corp ! akamai ! com
[Download RAW message or body]

We're seeing some weird traffic that isn't really a problem, but was
peculiar enough to want to ask others about.

There's an AWS IP that has hit several dozen unrelated zones hosted on
us, specifically looking for a set of names under an empty
non-terminal.  The IP hasn't shown up in any other bad-actor
reputation data, and isn't a high volume of queries.  It is consistent
however in asking for:

(store|secure|www|ssl|mail).$EMPTY-NON-TERMINAL.$ZONE.

Anyone else seen this? 


_______________________________________________
dns-operations mailing list
dns-operations@lists.dns-oarc.net
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-operations mailing list
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
[prev in list] [next in list] [prev in thread] [next in thread]