'Re: [dns-operations] in-addr.arpa spikes in DNS traffic'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dns-operations
Subject:    Re: [dns-operations] in-addr.arpa spikes in DNS traffic
From:       abang () t-ipnet ! net
Date:       2019-01-09 17:10:24
Message-ID: A43C2093-3A78-4176-AD43-E6B71258A3B9 () t-ipnet ! net
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]

Hypothesis:
Large network scans or ddos attacks against cloud provider could cause that. \
Firewalls and also "personal" firewalls of consumer  broadband connections tries to \
resolve the PTR RRs for logging or analysis purposes.

Winfried

Am 9. Januar 2019 15:40:28 MEZ schrieb "MONROE, JEREMY" <jm9386@att.com>:
> To clarify – We are seeing the spikes in PTR/in-addr.arpa lookups on
> domains we are authoritative for in the ISP arena – recurring on 16
> hour intervals.  I've received reports that at least one other ISP has
> noticed the same thing.
> 
> Jeremy Monroe
> Q Me qto://talk/jm9386
> Senior - IT Network Design
> Enterprise IP Services Support
> AT&T Services Inc – Network Cloud and Infrastructure Ops
> Intranet: http://eiss.it.att.com<http://eiss.it.att.com/>
> http://eiss-dns.it.att.com<http://eiss-dns.it.att.com/>
> 573 204 5463 Skype/office
> 314 235 8168 (AT&T Domains voice mailbox)
> 3146508345@txt.att.net<mailto:3146508345@txt.att.net> Pager
> 314 650 8345 Cell
> "I don't know the secret to success, but the secret to failure is to
> try and please everyone"
> 
> "This e-mail and any files transmitted with it are the property of
> at&t, are confidential, and are intended solely for the use of the
> individual or entity to whom this e-mail is addressed. If you are not
> one of the named recipient or otherwise have reason to believe that you
> have received this message in error, please notify the sender at
> [jm9386@att.com or 314 235 8168] and delete this message immediately
> from your computer. Any other use, retention, dissemination,
> forwarding, printing, or copying of this e-mail is strictly
> prohibited."
> 
> From: Hellqvist, Björn <bjorn.hellqvist@teliacompany.com>
> Sent: Monday, January 07, 2019 02:40
> To: MONROE, JEREMY <jm9386@att.com>; dns-operations@dns-oarc.net;
> ask-rssac@icann.org
> Subject: RE: in-addr.arpa spikes in DNS traffic
> 
> 
> Hi,
> 
> We have also noticed similar bursts in the past. Maybe not at those
> rates, but significantly larger than normal. In the magnitude of 10-20x
> of normal traffic, and only from a small amount of sources.
> 
> The main IP's at the time was AWS servers. My conclusion at the time
> was that some sites did reverse lookups without using a caching
> resolver. I might have reached out to Amazon, but I can't remember. It
> was a couple of years ago.
> 
> I also saw some of the larger Swedish web hosting companies at that
> time, which I did reach out to.
> 
> Since the traffic was no threat of overloading our authoritative
> servers, I let them pass.
> 
> Have not looked at it for a while though.
> 
> BR,
> Bjorn Hellqvist
> Senior System Expert (Internet, DNS & Automation)
> Telia Company
> Solna, Sweden
> 
> 
> 
> From: dns-operations [mailto:dns-operations-bounces@dns-oarc.net] On
> Behalf Of MONROE, JEREMY
> Sent: den 22 december 2018 16:35
> To: dns-operations@dns-oarc.net<mailto:dns-operations@dns-oarc.net>;
> ask-rssac@icann.org<mailto:ask-rssac@icann.org>
> Subject: [dns-operations] in-addr.arpa spikes in DNS traffic
> 
> Please see below – AT&T has received bursts in PTR queries as described
> below – has anyone hear seen similar behavior recently?  This first
> occurred in March of 2018 – subsided and began again here in December.
> 
> Jeremy Monroe
> Q Me qto://talk/jm9386
> Senior - IT Network Design
> Enterprise IP Services Support
> AT&T Services Inc – Network Cloud and Infrastructure Ops
> Intranet: http://eiss.it.att.com<http://eiss.it.att.com/>
> http://eiss-dns.it.att.com<http://eiss-dns.it.att.com/>
> 573 204 5463 Skype/office
> 314 235 8168 (AT&T Domains voice mailbox)
> 3146508345@txt.att.net<mailto:3146508345@txt.att.net> Pager
> 314 650 8345 Cell
> "I don't know the secret to success, but the secret to failure is to
> try and please everyone"
> 
> "This e-mail and any files transmitted with it are the property of
> at&t, are confidential, and are intended solely for the use of the
> individual or entity to whom this e-mail is addressed. If you are not
> one of the named recipient or otherwise have reason to believe that you
> have received this message in error, please notify the sender at
> [jm9386@att.com or 314 235 8168] and delete this message immediately
> from your computer. Any other use, retention, dissemination,
> forwarding, printing, or copying of this e-mail is strictly
> prohibited."
> 
> From: Wessels, Duane
> <dwessels@verisign.com<mailto:dwessels@verisign.com>>
> Sent: Friday, December 21, 2018 16:05
> To: MONROE, JEREMY <jm9386@att.com<mailto:jm9386@att.com>>
> Subject: Re: RE: in-addr.arpa spikes in DNS traffic
> 
> Yeah that's an odd one.  If the IPs are real (not spoofed) and you see
> queries that you are authoritative for, then it would point to
> something generating large amounts of queries through legitimate
> recursives.
> 
> We asked our root server colleagues they saw anything like that.  Only
> one responded so far, and said (like us) they did not.
> 
> As you may know, root servers typically handle in the range of 50k q/s
> these days.  The 200-400k that you observe would definitely be
> noticeable.
> 
> Currently the only reasonable way you could reach all the root
> operators is to send email to
> ask-rssac@icann.org<mailto:ask-rssac@icann.org>.  Someone would receive
> it and then forward it to the operators.  Given the timing with
> holidays I wouldn't hold your breath.
> 
> You might also consider posting to the
> dns-operations@dns-oarc.net<mailto:dns-operations@dns-oarc.net> mailing
> list to reach other DNS operators more broadly.
> 
> DW
> 
> 
> From: "MONROE, JEREMY" <jm9386@att.com<mailto:jm9386@att.com>>
> Date: Friday, December 21, 2018 at 1:48 PM
> To: Duane Wessels <dwessels@verisign.com<mailto:dwessels@verisign.com>>
> Subject: [EXTERNAL] RE: in-addr.arpa spikes in DNS traffic
> 
> We are seeing short bursts of PTR query traffic.  Sources seem to be
> all open ISP resolvers scattered all over the United States.  I host a
> bunch of in-addr.arpa zones from top level delegations and each of the
> queries appears to be for legitimate PTR records that we have defined. 
> We typically receive about 7-10kpps (Packets Per Second) (not terribly
> large) and over the last week or two have received what seems like
> coordinated bursts of up and over 200-400kpps of all PTR records. 
> First observed in the United States – but today I learned our European
> based resolvers have also received similar spikes.  My assumption was
> that if a bunch of ISP resolvers began receiving PTR queries for
> recursion – that the root servers might have seen an increase in folks
> asking what DNS servers to use for certain in-addr.arpa space at AT&T. 
> We have not seen a significant number of queries for arpa's that we are
> not authoritative for – it's an odd MO.
> 
> Thank you for taking the time to reply back.  Is there any way to see
> if any of the other root-server providers have noticed anything of that
> sort?  Im really grasping at straws at this point.
> 
> Jeremy Monroe
> Q Me qto://talk/jm9386
> Senior - IT Network Design
> Enterprise IP Services Support
> AT&T Services Inc – Network Cloud and Infrastructure Ops
> Intranet: http://eiss.it.att.com<http://eiss.it.att.com/>
> http://eiss-dns.it.att.com<http://eiss-dns.it.att.com/>
> 573 204 5463 Skype/office
> 314 235 8168 (AT&T Domains voice mailbox)
> 3146508345@txt.att.net<mailto:3146508345@txt.att.net> Pager
> 314 650 8345 Cell
> "I don't know the secret to success, but the secret to failure is to
> try and please everyone"
> 
> "This e-mail and any files transmitted with it are the property of
> at&t, are confidential, and are intended solely for the use of the
> individual or entity to whom this e-mail is addressed. If you are not
> one of the named recipient or otherwise have reason to believe that you
> have received this message in error, please notify the sender at
> [jm9386@att.com or 314 235 8168] and delete this message immediately
> from your computer. Any other use, retention, dissemination,
> forwarding, printing, or copying of this e-mail is strictly
> prohibited."
> 
> From: Wessels, Duane
> <dwessels@verisign.com<mailto:dwessels@verisign.com>>
> Sent: Friday, December 21, 2018 15:37
> To: MONROE, JEREMY <jm9386@att.com<mailto:jm9386@att.com>>
> Subject: Re: in-addr.arpa spikes in DNS traffic
> 
> Jeremy,
> 
> We don't see anything like that here.  You mentioned both PTR and NS
> queries.  Are you seeing both, or is it one or the other?
> 
> What you describe could be caused by availability issues with the lower
> levels of the DNS.  Did you notice any similarities in the names being
> queried?
> 
> DW
> 
> 
> From: "MONROE, JEREMY" <jm9386@att.com<mailto:jm9386@att.com>>
> Date: Friday, December 21, 2018 at 7:52 AM
> To: rootdns <rootdns@verisign.com<mailto:rootdns@verisign.com>>
> Subject: [EXTERNAL] in-addr.arpa spikes in DNS traffic
> 
> Hello – Im looking into a few network events where we received huge
> spikes in what appears to be valid PTR record lookups for zones to
> which we are authoritative for.  Can you confirm whether or not the
> root servers have seen similar spikes in in-addr.arpa related NS
> queries?
> 
> Jeremy Monroe
> Q Me qto://talk/jm9386
> Senior - IT Network Design
> Enterprise IP Services Support
> AT&T Services Inc – Network Cloud and Infrastructure Ops
> Intranet: http://eiss.it.att.com<http://eiss.it.att.com/>
> http://eiss-dns.it.att.com<http://eiss-dns.it.att.com/>
> 573 204 5463 Skype/office
> 314 235 8168 (AT&T Domains voice mailbox)
> 3146508345@txt.att.net<mailto:3146508345@txt.att.net> Pager
> 314 650 8345 Cell
> "I don't know the secret to success, but the secret to failure is to
> try and please everyone"
> 
> "This e-mail and any files transmitted with it are the property of
> at&t, are confidential, and are intended solely for the use of the
> individual or entity to whom this e-mail is addressed. If you are not
> one of the named recipient or otherwise have reason to believe that you
> have received this message in error, please notify the sender at
> [jm9386@att.com or 314 235 8168] and delete this message immediately
> from your computer. Any other use, retention, dissemination,
> forwarding, printing, or copying of this e-mail is strictly
> prohibited."

[Attachment #5 (text/html)]

<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="ProgId" content="Word.Document">
<meta name="Generator" content="Microsoft Word 15">
<meta name="Originator" content="Microsoft Word 15">
<link rel="File-List" href="cid:filelist.xml@01D4A7F6.F819F0B0"><!--[if gte mso \
9]><xml> <o:OfficeDocumentSettings>
<o:AllowPNG/>
</o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:WordDocument>
<w:SpellingState>Clean</w:SpellingState>
<w:GrammarState>Clean</w:GrammarState>
<w:DocumentKind>DocumentEmail</w:DocumentKind>
<w:TrackMoves/>
<w:TrackFormatting/>
<w:EnvelopeVis/>
<w:ValidateAgainstSchemas/>
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
<w:DoNotPromoteQF/>
<w:LidThemeOther>EN-US</w:LidThemeOther>
<w:LidThemeAsian>X-NONE</w:LidThemeAsian>
<w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript>
<w:Compatibility>
<w:DoNotExpandShiftReturn/>
<w:BreakWrappedTables/>
<w:SplitPgBreakAndParaMark/>
<w:EnableOpenTypeKerning/>
</w:Compatibility>
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
<m:mathPr>
<m:mathFont m:val="Cambria Math"/>
<m:brkBin m:val="before"/>
<m:brkBinSub m:val="&#45;-"/>
<m:smallFrac m:val="off"/>
<m:dispDef/>
<m:lMargin m:val="0"/>
<m:rMargin m:val="0"/>
<m:defJc m:val="centerGroup"/>
<m:wrapIndent m:val="1440"/>
<m:intLim m:val="subSup"/>
<m:naryLim m:val="undOvr"/>
</m:mathPr></w:WordDocument>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="false" \
DefSemiHidden="false" DefQFormat="false" DefPriority="99" LatentStyleCount="375"> \
<w:LsdException Locked="false" Priority="0" QFormat="true" Name="Normal"/> \
<w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 1"/> \
<w:LsdException Locked="false" Priority="9" SemiHidden="true" UnhideWhenUsed="true" \
QFormat="true" Name="heading 2"/> <w:LsdException Locked="false" Priority="9" \
SemiHidden="true" UnhideWhenUsed="true" QFormat="true" Name="heading 3"/> \
<w:LsdException Locked="false" Priority="9" SemiHidden="true" UnhideWhenUsed="true" \
QFormat="true" Name="heading 4"/> <w:LsdException Locked="false" Priority="9" \
SemiHidden="true" UnhideWhenUsed="true" QFormat="true" Name="heading 5"/> \
<w:LsdException Locked="false" Priority="9" SemiHidden="true" UnhideWhenUsed="true" \
QFormat="true" Name="heading 6"/> <w:LsdException Locked="false" Priority="9" \
SemiHidden="true" UnhideWhenUsed="true" QFormat="true" Name="heading 7"/> \
<w:LsdException Locked="false" Priority="9" SemiHidden="true" UnhideWhenUsed="true" \
QFormat="true" Name="heading 8"/> <w:LsdException Locked="false" Priority="9" \
SemiHidden="true" UnhideWhenUsed="true" QFormat="true" Name="heading 9"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="index \
1"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="index 2"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="index 3"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="index 4"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="index 5"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="index \
6"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="index 7"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="index 8"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="index 9"/> <w:LsdException \
Locked="false" Priority="39" SemiHidden="true" UnhideWhenUsed="true" Name="toc 1"/> \
<w:LsdException Locked="false" Priority="39" SemiHidden="true" UnhideWhenUsed="true" \
Name="toc 2"/> <w:LsdException Locked="false" Priority="39" SemiHidden="true" \
UnhideWhenUsed="true" Name="toc 3"/> <w:LsdException Locked="false" Priority="39" \
SemiHidden="true" UnhideWhenUsed="true" Name="toc 4"/> <w:LsdException Locked="false" \
Priority="39" SemiHidden="true" UnhideWhenUsed="true" Name="toc 5"/> <w:LsdException \
Locked="false" Priority="39" SemiHidden="true" UnhideWhenUsed="true" Name="toc 6"/> \
<w:LsdException Locked="false" Priority="39" SemiHidden="true" UnhideWhenUsed="true" \
Name="toc 7"/> <w:LsdException Locked="false" Priority="39" SemiHidden="true" \
UnhideWhenUsed="true" Name="toc 8"/> <w:LsdException Locked="false" Priority="39" \
SemiHidden="true" UnhideWhenUsed="true" Name="toc 9"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Normal Indent"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="footnote text"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="annotation text"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="header"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="footer"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="index heading"/> \
<w:LsdException Locked="false" Priority="35" SemiHidden="true" UnhideWhenUsed="true" \
QFormat="true" Name="caption"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="table of figures"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="envelope address"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="envelope return"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="footnote \
reference"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="annotation reference"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="line number"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="page number"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="endnote reference"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="endnote \
text"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="table of authorities"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="macro"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="toa heading"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="List"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="List Bullet"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="List Number"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="List \
2"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="List 3"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="List 4"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="List 5"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="List Bullet 2"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="List \
Bullet 3"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="List Bullet 4"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="List Bullet 5"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="List Number 2"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="List Number 3"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="List \
Number 4"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="List Number 5"/> <w:LsdException Locked="false" Priority="10" QFormat="true" \
Name="Title"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Closing"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Signature"/> <w:LsdException Locked="false" Priority="1" \
SemiHidden="true" UnhideWhenUsed="true" Name="Default Paragraph Font"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Body \
Text"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Body Text Indent"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="List Continue"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="List Continue 2"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="List Continue 3"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="List \
Continue 4"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="List Continue 5"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Message Header"/> <w:LsdException Locked="false" \
Priority="11" QFormat="true" Name="Subtitle"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Salutation"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Date"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Body Text First \
Indent"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Body Text First Indent 2"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Note Heading"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Body Text 2"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Body Text 3"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Body \
Text Indent 2"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Body Text Indent 3"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Block Text"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Hyperlink"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="FollowedHyperlink"/> <w:LsdException Locked="false" Priority="22" \
QFormat="true" Name="Strong"/> <w:LsdException Locked="false" Priority="20" \
QFormat="true" Name="Emphasis"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Document Map"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Plain Text"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="E-mail Signature"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="HTML Top \
of Form"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="HTML Bottom of Form"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Normal (Web)"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="HTML Acronym"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="HTML Address"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="HTML \
Cite"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="HTML Code"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="HTML Definition"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="HTML Keyboard"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="HTML Preformatted"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="HTML \
Sample"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="HTML Typewriter"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="HTML Variable"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Normal Table"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="annotation subject"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="No \
List"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Outline List 1"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Outline List 2"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Outline List 3"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table Simple 1"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table \
Simple 2"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Table Simple 3"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table Classic 1"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Table Classic 2"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table Classic 3"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table \
Classic 4"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Table Colorful 1"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table Colorful 2"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Table Colorful 3"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table Columns 1"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table \
Columns 2"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Table Columns 3"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table Columns 4"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Table Columns 5"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table Grid 1"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table \
Grid 2"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Table Grid 3"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table Grid 4"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Table Grid 5"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table Grid 6"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table \
Grid 7"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Table Grid 8"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table List 1"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Table List 2"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table List 3"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table \
List 4"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Table List 5"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table List 6"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Table List 7"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table List 8"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table 3D \
effects 1"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Table 3D effects 2"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table 3D effects 3"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Table Contemporary"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table Elegant"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table \
Professional"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table Subtle 1"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Table Subtle 2"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table Web 1"/> \
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Table \
Web 2"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Table Web 3"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Balloon Text"/> <w:LsdException Locked="false" \
Priority="39" Name="Table Grid"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Table Theme"/> <w:LsdException Locked="false" \
SemiHidden="true" Name="Placeholder Text"/> <w:LsdException Locked="false" \
Priority="1" QFormat="true" Name="No Spacing"/> <w:LsdException Locked="false" \
Priority="60" Name="Light Shading"/> <w:LsdException Locked="false" Priority="61" \
Name="Light List"/> <w:LsdException Locked="false" Priority="62" Name="Light Grid"/>
<w:LsdException Locked="false" Priority="63" Name="Medium Shading 1"/>
<w:LsdException Locked="false" Priority="64" Name="Medium Shading 2"/>
<w:LsdException Locked="false" Priority="65" Name="Medium List 1"/>
<w:LsdException Locked="false" Priority="66" Name="Medium List 2"/>
<w:LsdException Locked="false" Priority="67" Name="Medium Grid 1"/>
<w:LsdException Locked="false" Priority="68" Name="Medium Grid 2"/>
<w:LsdException Locked="false" Priority="69" Name="Medium Grid 3"/>
<w:LsdException Locked="false" Priority="70" Name="Dark List"/>
<w:LsdException Locked="false" Priority="71" Name="Colorful Shading"/>
<w:LsdException Locked="false" Priority="72" Name="Colorful List"/>
<w:LsdException Locked="false" Priority="73" Name="Colorful Grid"/>
<w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 1"/>
<w:LsdException Locked="false" Priority="61" Name="Light List Accent 1"/>
<w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 1"/>
<w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 1"/>
<w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 1"/>
<w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 1"/>
<w:LsdException Locked="false" SemiHidden="true" Name="Revision"/>
<w:LsdException Locked="false" Priority="34" QFormat="true" Name="List Paragraph"/>
<w:LsdException Locked="false" Priority="29" QFormat="true" Name="Quote"/>
<w:LsdException Locked="false" Priority="30" QFormat="true" Name="Intense Quote"/>
<w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 1"/>
<w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 1"/>
<w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 1"/>
<w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 1"/>
<w:LsdException Locked="false" Priority="70" Name="Dark List Accent 1"/>
<w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 1"/>
<w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 1"/>
<w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 1"/>
<w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 2"/>
<w:LsdException Locked="false" Priority="61" Name="Light List Accent 2"/>
<w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 2"/>
<w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 2"/>
<w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 2"/>
<w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 2"/>
<w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 2"/>
<w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 2"/>
<w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 2"/>
<w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 2"/>
<w:LsdException Locked="false" Priority="70" Name="Dark List Accent 2"/>
<w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 2"/>
<w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 2"/>
<w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 2"/>
<w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 3"/>
<w:LsdException Locked="false" Priority="61" Name="Light List Accent 3"/>
<w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 3"/>
<w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 3"/>
<w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 3"/>
<w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 3"/>
<w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 3"/>
<w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 3"/>
<w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 3"/>
<w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 3"/>
<w:LsdException Locked="false" Priority="70" Name="Dark List Accent 3"/>
<w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 3"/>
<w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 3"/>
<w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 3"/>
<w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 4"/>
<w:LsdException Locked="false" Priority="61" Name="Light List Accent 4"/>
<w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 4"/>
<w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 4"/>
<w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 4"/>
<w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 4"/>
<w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 4"/>
<w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 4"/>
<w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 4"/>
<w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 4"/>
<w:LsdException Locked="false" Priority="70" Name="Dark List Accent 4"/>
<w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 4"/>
<w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 4"/>
<w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 4"/>
<w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 5"/>
<w:LsdException Locked="false" Priority="61" Name="Light List Accent 5"/>
<w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 5"/>
<w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 5"/>
<w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 5"/>
<w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 5"/>
<w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 5"/>
<w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 5"/>
<w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 5"/>
<w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 5"/>
<w:LsdException Locked="false" Priority="70" Name="Dark List Accent 5"/>
<w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 5"/>
<w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 5"/>
<w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 5"/>
<w:LsdException Locked="false" Priority="60" Name="Light Shading Accent 6"/>
<w:LsdException Locked="false" Priority="61" Name="Light List Accent 6"/>
<w:LsdException Locked="false" Priority="62" Name="Light Grid Accent 6"/>
<w:LsdException Locked="false" Priority="63" Name="Medium Shading 1 Accent 6"/>
<w:LsdException Locked="false" Priority="64" Name="Medium Shading 2 Accent 6"/>
<w:LsdException Locked="false" Priority="65" Name="Medium List 1 Accent 6"/>
<w:LsdException Locked="false" Priority="66" Name="Medium List 2 Accent 6"/>
<w:LsdException Locked="false" Priority="67" Name="Medium Grid 1 Accent 6"/>
<w:LsdException Locked="false" Priority="68" Name="Medium Grid 2 Accent 6"/>
<w:LsdException Locked="false" Priority="69" Name="Medium Grid 3 Accent 6"/>
<w:LsdException Locked="false" Priority="70" Name="Dark List Accent 6"/>
<w:LsdException Locked="false" Priority="71" Name="Colorful Shading Accent 6"/>
<w:LsdException Locked="false" Priority="72" Name="Colorful List Accent 6"/>
<w:LsdException Locked="false" Priority="73" Name="Colorful Grid Accent 6"/>
<w:LsdException Locked="false" Priority="19" QFormat="true" Name="Subtle Emphasis"/>
<w:LsdException Locked="false" Priority="21" QFormat="true" Name="Intense Emphasis"/>
<w:LsdException Locked="false" Priority="31" QFormat="true" Name="Subtle Reference"/>
<w:LsdException Locked="false" Priority="32" QFormat="true" Name="Intense \
Reference"/> <w:LsdException Locked="false" Priority="33" QFormat="true" Name="Book \
Title"/> <w:LsdException Locked="false" Priority="37" SemiHidden="true" \
UnhideWhenUsed="true" Name="Bibliography"/> <w:LsdException Locked="false" \
Priority="39" SemiHidden="true" UnhideWhenUsed="true" QFormat="true" Name="TOC \
Heading"/> <w:LsdException Locked="false" Priority="41" Name="Plain Table 1"/>
<w:LsdException Locked="false" Priority="42" Name="Plain Table 2"/>
<w:LsdException Locked="false" Priority="43" Name="Plain Table 3"/>
<w:LsdException Locked="false" Priority="44" Name="Plain Table 4"/>
<w:LsdException Locked="false" Priority="45" Name="Plain Table 5"/>
<w:LsdException Locked="false" Priority="40" Name="Grid Table Light"/>
<w:LsdException Locked="false" Priority="46" Name="Grid Table 1 Light"/>
<w:LsdException Locked="false" Priority="47" Name="Grid Table 2"/>
<w:LsdException Locked="false" Priority="48" Name="Grid Table 3"/>
<w:LsdException Locked="false" Priority="49" Name="Grid Table 4"/>
<w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark"/>
<w:LsdException Locked="false" Priority="51" Name="Grid Table 6 Colorful"/>
<w:LsdException Locked="false" Priority="52" Name="Grid Table 7 Colorful"/>
<w:LsdException Locked="false" Priority="46" Name="Grid Table 1 Light Accent 1"/>
<w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 1"/>
<w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 1"/>
<w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 1"/>
<w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 1"/>
<w:LsdException Locked="false" Priority="51" Name="Grid Table 6 Colorful Accent 1"/>
<w:LsdException Locked="false" Priority="52" Name="Grid Table 7 Colorful Accent 1"/>
<w:LsdException Locked="false" Priority="46" Name="Grid Table 1 Light Accent 2"/>
<w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 2"/>
<w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 2"/>
<w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 2"/>
<w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 2"/>
<w:LsdException Locked="false" Priority="51" Name="Grid Table 6 Colorful Accent 2"/>
<w:LsdException Locked="false" Priority="52" Name="Grid Table 7 Colorful Accent 2"/>
<w:LsdException Locked="false" Priority="46" Name="Grid Table 1 Light Accent 3"/>
<w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 3"/>
<w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 3"/>
<w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 3"/>
<w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 3"/>
<w:LsdException Locked="false" Priority="51" Name="Grid Table 6 Colorful Accent 3"/>
<w:LsdException Locked="false" Priority="52" Name="Grid Table 7 Colorful Accent 3"/>
<w:LsdException Locked="false" Priority="46" Name="Grid Table 1 Light Accent 4"/>
<w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 4"/>
<w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 4"/>
<w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 4"/>
<w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 4"/>
<w:LsdException Locked="false" Priority="51" Name="Grid Table 6 Colorful Accent 4"/>
<w:LsdException Locked="false" Priority="52" Name="Grid Table 7 Colorful Accent 4"/>
<w:LsdException Locked="false" Priority="46" Name="Grid Table 1 Light Accent 5"/>
<w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 5"/>
<w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 5"/>
<w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 5"/>
<w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 5"/>
<w:LsdException Locked="false" Priority="51" Name="Grid Table 6 Colorful Accent 5"/>
<w:LsdException Locked="false" Priority="52" Name="Grid Table 7 Colorful Accent 5"/>
<w:LsdException Locked="false" Priority="46" Name="Grid Table 1 Light Accent 6"/>
<w:LsdException Locked="false" Priority="47" Name="Grid Table 2 Accent 6"/>
<w:LsdException Locked="false" Priority="48" Name="Grid Table 3 Accent 6"/>
<w:LsdException Locked="false" Priority="49" Name="Grid Table 4 Accent 6"/>
<w:LsdException Locked="false" Priority="50" Name="Grid Table 5 Dark Accent 6"/>
<w:LsdException Locked="false" Priority="51" Name="Grid Table 6 Colorful Accent 6"/>
<w:LsdException Locked="false" Priority="52" Name="Grid Table 7 Colorful Accent 6"/>
<w:LsdException Locked="false" Priority="46" Name="List Table 1 Light"/>
<w:LsdException Locked="false" Priority="47" Name="List Table 2"/>
<w:LsdException Locked="false" Priority="48" Name="List Table 3"/>
<w:LsdException Locked="false" Priority="49" Name="List Table 4"/>
<w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark"/>
<w:LsdException Locked="false" Priority="51" Name="List Table 6 Colorful"/>
<w:LsdException Locked="false" Priority="52" Name="List Table 7 Colorful"/>
<w:LsdException Locked="false" Priority="46" Name="List Table 1 Light Accent 1"/>
<w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 1"/>
<w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 1"/>
<w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 1"/>
<w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 1"/>
<w:LsdException Locked="false" Priority="51" Name="List Table 6 Colorful Accent 1"/>
<w:LsdException Locked="false" Priority="52" Name="List Table 7 Colorful Accent 1"/>
<w:LsdException Locked="false" Priority="46" Name="List Table 1 Light Accent 2"/>
<w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 2"/>
<w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 2"/>
<w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 2"/>
<w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 2"/>
<w:LsdException Locked="false" Priority="51" Name="List Table 6 Colorful Accent 2"/>
<w:LsdException Locked="false" Priority="52" Name="List Table 7 Colorful Accent 2"/>
<w:LsdException Locked="false" Priority="46" Name="List Table 1 Light Accent 3"/>
<w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 3"/>
<w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 3"/>
<w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 3"/>
<w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 3"/>
<w:LsdException Locked="false" Priority="51" Name="List Table 6 Colorful Accent 3"/>
<w:LsdException Locked="false" Priority="52" Name="List Table 7 Colorful Accent 3"/>
<w:LsdException Locked="false" Priority="46" Name="List Table 1 Light Accent 4"/>
<w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 4"/>
<w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 4"/>
<w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 4"/>
<w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 4"/>
<w:LsdException Locked="false" Priority="51" Name="List Table 6 Colorful Accent 4"/>
<w:LsdException Locked="false" Priority="52" Name="List Table 7 Colorful Accent 4"/>
<w:LsdException Locked="false" Priority="46" Name="List Table 1 Light Accent 5"/>
<w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 5"/>
<w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 5"/>
<w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 5"/>
<w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 5"/>
<w:LsdException Locked="false" Priority="51" Name="List Table 6 Colorful Accent 5"/>
<w:LsdException Locked="false" Priority="52" Name="List Table 7 Colorful Accent 5"/>
<w:LsdException Locked="false" Priority="46" Name="List Table 1 Light Accent 6"/>
<w:LsdException Locked="false" Priority="47" Name="List Table 2 Accent 6"/>
<w:LsdException Locked="false" Priority="48" Name="List Table 3 Accent 6"/>
<w:LsdException Locked="false" Priority="49" Name="List Table 4 Accent 6"/>
<w:LsdException Locked="false" Priority="50" Name="List Table 5 Dark Accent 6"/>
<w:LsdException Locked="false" Priority="51" Name="List Table 6 Colorful Accent 6"/>
<w:LsdException Locked="false" Priority="52" Name="List Table 7 Colorful Accent 6"/>
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" \
Name="Mention"/> <w:LsdException Locked="false" SemiHidden="true" \
UnhideWhenUsed="true" Name="Smart Hyperlink"/> <w:LsdException Locked="false" \
SemiHidden="true" UnhideWhenUsed="true" Name="Hashtag"/> <w:LsdException \
Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="Unresolved Mention"/> \
</w:LatentStyles> </xml><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;
	mso-font-alt:"Palatino Linotype";
	mso-font-charset:0;
	mso-generic-font-family:roman;
	mso-font-pitch:variable;
	mso-font-signature:-536870145 1107305727 0 0 415 0;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;
	mso-font-alt:"Century Gothic";
	mso-font-charset:0;
	mso-generic-font-family:swiss;
	mso-font-pitch:variable;
	mso-font-signature:-520092929 1073786111 9 0 415 0;}
@font-face
	{font-family:"Lucida Sans Unicode";
	panose-1:2 11 6 2 3 5 4 2 2 4;
	mso-font-alt:"Lucida Sans Unicode";
	mso-font-charset:0;
	mso-generic-font-family:swiss;
	mso-font-pitch:variable;
	mso-font-signature:-2147480833 14699 0 0 191 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{mso-style-unhide:no;
	mso-style-qformat:yes;
	mso-style-parent:"";
	margin:0in;
	margin-bottom:.0001pt;
	mso-pagination:widow-orphan;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;
	mso-fareast-font-family:Calibri;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;
	text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-noshow:yes;
	mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;
	text-underline:single;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-style-unhide:no;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:0in;
	mso-pagination:widow-orphan;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;
	mso-fareast-font-family:Calibri;}
span.EmailStyle18
	{mso-style-type:personal;
	mso-style-noshow:yes;
	mso-style-unhide:no;
	font-family:"Calibri",sans-serif;
	mso-ascii-font-family:Calibri;
	mso-hansi-font-family:Calibri;
	mso-bidi-font-family:Calibri;
	color:windowtext;}
span.EmailStyle19
	{mso-style-type:personal;
	mso-style-noshow:yes;
	mso-style-unhide:no;
	font-family:"Calibri",sans-serif;
	mso-ascii-font-family:Calibri;
	mso-hansi-font-family:Calibri;
	mso-bidi-font-family:Calibri;
	color:windowtext;}
span.EmailStyle20
	{mso-style-type:personal;
	mso-style-noshow:yes;
	mso-style-unhide:no;
	font-family:"Calibri",sans-serif;
	mso-ascii-font-family:Calibri;
	mso-hansi-font-family:Calibri;
	mso-bidi-font-family:Calibri;
	color:windowtext;}
span.EmailStyle21
	{mso-style-type:personal;
	mso-style-noshow:yes;
	mso-style-unhide:no;
	font-family:"Calibri",sans-serif;
	mso-ascii-font-family:Calibri;
	mso-hansi-font-family:Calibri;
	mso-bidi-font-family:Calibri;
	color:windowtext;}
span.EmailStyle22
	{mso-style-type:personal;
	mso-style-noshow:yes;
	mso-style-unhide:no;
	font-family:"Calibri",sans-serif;
	mso-ascii-font-family:Calibri;
	mso-hansi-font-family:Calibri;
	mso-bidi-font-family:Calibri;
	color:windowtext;}
span.EmailStyle23
	{mso-style-type:personal;
	mso-style-noshow:yes;
	mso-style-unhide:no;
	font-family:"Calibri",sans-serif;
	mso-ascii-font-family:Calibri;
	mso-hansi-font-family:Calibri;
	mso-bidi-font-family:Calibri;
	color:#1F497D;}
span.EmailStyle25
	{mso-style-type:personal-reply;
	mso-style-noshow:yes;
	mso-style-unhide:no;
	mso-ansi-font-size:11.0pt;
	mso-bidi-font-size:11.0pt;
	font-family:"Calibri",sans-serif;
	mso-ascii-font-family:Calibri;
	mso-fareast-font-family:Calibri;
	mso-hansi-font-family:Calibri;
	mso-bidi-font-family:"Times New Roman";
	color:windowtext;}
span.SpellE
	{mso-style-name:"";
	mso-spl-e:yes;}
span.GramE
	{mso-style-name:"";
	mso-gram-e:yes;}
.MsoChpDefault
	{mso-style-type:export-only;
	mso-default-props:yes;
	font-size:10.0pt;
	mso-ansi-font-size:10.0pt;
	mso-bidi-font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;
	mso-header-margin:.5in;
	mso-footer-margin:.5in;
	mso-paper-source:0;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 10]><style>/* Style Definitions */
table.MsoNormalTable
	{mso-style-name:"Table Normal";
	mso-tstyle-rowband-size:0;
	mso-tstyle-colband-size:0;
	mso-style-noshow:yes;
	mso-style-priority:99;
	mso-style-parent:"";
	mso-padding-alt:0in 5.4pt 0in 5.4pt;
	mso-para-margin:0in;
	mso-para-margin-bottom:.0001pt;
	mso-pagination:widow-orphan;
	font-size:10.0pt;
	font-family:"Times New Roman",serif;}
</style><![endif]--><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" \
style="tab-interval:.5in">Hypothesis:<br>Large network scans or ddos attacks against \
cloud provider could cause that. Firewalls and also "personal" firewalls of consumer  \
broadband connections tries to resolve the PTR RRs for logging or analysis \
purposes.<br><br>Winfried<br><br><br><br><div class="gmail_quote">Am 9. Januar 2019 \
15:40:28 MEZ schrieb "MONROE, JEREMY" &lt;jm9386@att.com&gt;:<blockquote \
class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, \
204, 204); padding-left: 1ex;">

<div class="WordSection1">
To clarify – We are seeing the spikes in PTR/in-addr.arpa lookups on domains we are authoritative for in the \
ISP arena – recurring on 16 hour intervals.&nbsp; I've received reports that at least one other \
ISP has noticed the same thing.<o:p></o:p> <o:p>&nbsp;</o:p> <div>
Jeremy Monroe<o:p></o:p> <span lang="EN" \
style="mso-ascii-font-family:Calibri;mso-fareast-font-family:&quot;Times New \
Roman&quot;;mso-hansi-font-family:Calibri;mso-bidi-font-family:&quot;Times New \
Roman&quot;;mso-ansi-language:EN;mso-no-proof:yes">Q Me <a href="qto://talk/jm9386">qto://talk/jm9386 </a><span \
style="mso-ascii-font-family:Calibri;mso-fareast-font-family:&quot;Times New \
Roman&quot;;mso-hansi-font-family:Calibri;mso-bidi-font-family:&quot;Times New \
Roman&quot;;color:red;mso-no-proof:yes"><o:p></o:p> Senior - IT Network Design<o:p></o:p> Enterprise IP Services \
Support<o:p></o:p> AT&amp;T Services Inc – Network Cloud \
and Infrastructure Ops <o:p></o:p> Intranet: <a href="http://eiss.it.att.com/">http://eiss.it.att.com</a> 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="http://eiss-dns.it.att.com/">http://eiss-dns.it.att.com</a> 
573 204 5463 \
Skype/office<o:p></o:p> 314 235 8168 (AT&amp;T Domains voice \
mailbox)<o:p></o:p> <a href="mailto:3146508345@txt.att.net">3146508345@txt.att.net</a> \
Pager <o:p></o:p> 314 650 8345 Cell &quot;I don't know the secret to \
success, but the secret to failure is to try and please everyone&quot; <o:p></o:p>
 &quot;This e-mail and any files transmitted \
with it are the property of at&amp;t, are confidential, and are intended solely for \
the use of the individual or entity to whom this e-mail is addressed. If you are not \
one of the named recipient or otherwise have reason to believe that you have received \
this message in error, please notify the sender at [jm9386@att.com or 314 235 8168] \
and delete this message immediately from your computer. Any other use, retention, \
dissemination, forwarding, printing, or copying of this e-mail is strictly \
prohibited.&quot;<o:p></o:p> </div>
<o:p>&nbsp;</o:p> <div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
From: Hellqvist, Björn &lt;bjorn.hellqvist@teliacompany.com&gt; 
Sent: Monday, January 07, 2019 02:40 
To: MONROE, JEREMY &lt;jm9386@att.com&gt;; dns-operations@dns-oarc.net; \
ask-rssac@icann.org Subject: RE: in-addr.arpa spikes in DNS \
traffic<o:p></o:p> </div>
</div>
<o:p>&nbsp;</o:p>
<o:p>&nbsp;</o:p>
Hi, <o:p></o:p>
<o:p>&nbsp;</o:p>
We have also noticed similar bursts \
in the past. Maybe not at those rates, but significantly larger than normal. In the \
magnitude of 10-20x of normal traffic, and only from a small amount of \
sources.<o:p></o:p> <o:p>&nbsp;</o:p> The main IP's at the time was AWS servers. My conclusion at the \
time was that some sites did reverse lookups without using a caching resolver. I \
might have reached out to Amazon, but I can't remember. It was a couple of years \
ago.<o:p></o:p> <o:p>&nbsp;</o:p> I also saw some of the larger Swedish web hosting companies at \
that time, which I did reach out to. <o:p></o:p>
<o:p>&nbsp;</o:p>
Since the traffic was no threat of \
overloading our authoritative servers, I let them pass. <o:p></o:p>
<o:p>&nbsp;</o:p>
Have not looked at it for a while \
though. <o:p></o:p>
<o:p>&nbsp;</o:p>
BR,<o:p></o:p> Bjorn \
Hellqvist<o:p></o:p> Senior System Expert (Internet, DNS &amp; \
Automation)<o:p></o:p> Telia Company<o:p></o:p> Solna, Sweden<o:p></o:p> <o:p>&nbsp;</o:p> <o:p>&nbsp;</o:p> <o:p>&nbsp;</o:p> <div style="border:none;border-left:solid \
blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
From: dns-operations [<a \
href="mailto:dns-operations-bounces@dns-oarc.net">mailto:dns-operations-bounces@dns-oarc.net</a>]
 On Behalf Of MONROE, JEREMY 
Sent: den 22 december 2018 16:35 
To: <a href="mailto:dns-operations@dns-oarc.net">dns-operations@dns-oarc.net</a>;
 <a href="mailto:ask-rssac@icann.org">ask-rssac@icann.org</a> 
Subject: [dns-operations] in-addr.arpa spikes in DNS traffic<o:p></o:p>
</div>
</div>
<o:p>&nbsp;</o:p>
Please see below – AT&amp;T has received bursts in PTR queries \
as described below – has anyone hear seen similar behavior recently?&nbsp; This \
first occurred in March of 2018 – subsided and began again here in \
December.<o:p></o:p> <o:p>&nbsp;</o:p>
<div>
Jeremy Monroe<o:p></o:p> Q Me <a \
href="qto://talk/jm9386">qto://talk/jm9386 \
</a><o:p></o:p> Senior - IT Network Design<o:p></o:p> Enterprise IP Services Support<o:p></o:p> AT&amp;T Services Inc \
– Network Cloud and Infrastructure Ops <o:p></o:p>
Intranet: <a \
href="http://eiss.it.att.com/">http://eiss.it.att.com</a> 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a \
href="http://eiss-dns.it.att.com/"> http://eiss-dns.it.att.com</a> 
573 204 5463 Skype/office<o:p></o:p> 314 235 8168 (AT&amp;T Domains voice \
mailbox)<o:p></o:p> <a \
href="mailto:3146508345@txt.att.net">3146508345@txt.att.net</a> Pager \
<o:p></o:p> 314 650 8345 Cell 
&quot;I \
don't know the secret to success, but the secret to failure is to try and please \
everyone&quot; <o:p></o:p>
 
&quot;This e-mail and any files transmitted with \
it are the property of at&amp;t, are confidential, and are intended solely for the \
use of the individual or entity to whom this e-mail is addressed. If you are not one \
of the named recipient or otherwise have reason to believe that you have received \
this message in error, please notify the sender at [jm9386@att.com or 314 235 8168] \
and delete this message immediately from your computer. Any other use, retention, \
dissemination, forwarding, printing, or copying of this e-mail is strictly \
prohibited.&quot;<o:p></o:p> </div>
<o:p>&nbsp;</o:p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
From: Wessels, Duane &lt;<a \
href="mailto:dwessels@verisign.com">dwessels@verisign.com</a>&gt; 
Sent: Friday, December 21, 2018 16:05 
To: MONROE, JEREMY &lt;<a \
href="mailto:jm9386@att.com">jm9386@att.com</a>&gt; Subject: Re: RE: \
in-addr.arpa spikes in DNS traffic<o:p></o:p> </div>
</div>
<o:p>&nbsp;</o:p>
Yeah that's an odd one.&nbsp; If the IPs are real (not spoofed) \
and you see queries that you are authoritative for, then it would point to something \
generating large amounts of queries through legitimate recursives.&nbsp; \
<o:p></o:p> <o:p>&nbsp;</o:p>
We asked our root server colleagues they saw anything like \
that.&nbsp; Only one responded so far, and said (like us) they did \
not.<o:p></o:p> <o:p>&nbsp;</o:p>
As you may know, root servers typically handle in the range of \
50k q/s these days.&nbsp; The 200-400k that you observe would definitely be \
noticeable.<o:p></o:p> <o:p>&nbsp;</o:p>
Currently the only reasonable way you could reach all the root \
operators is to send email to <a \
href="mailto:ask-rssac@icann.org">ask-rssac@icann.org</a>.&nbsp; Someone would \
receive it and then forward it to the operators.&nbsp; Given the timing with holidays \
I wouldn't hold your breath.<o:p></o:p> <o:p>&nbsp;</o:p> You might also consider \
posting to the <a href="mailto:dns-operations@dns-oarc.net"> \
dns-operations@dns-oarc.net</a> mailing list to reach other DNS operators more \
broadly.&nbsp; <o:p></o:p>
<o:p>&nbsp;</o:p>
DW<o:p></o:p>
<o:p>&nbsp;</o:p>
<o:p>&nbsp;</o:p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
From: &quot;MONROE, JEREMY&quot; &lt;<a \
href="mailto:jm9386@att.com">jm9386@att.com</a>&gt; Date: Friday, December \
21, 2018 at 1:48 PM To: Duane Wessels &lt;<a \
href="mailto:dwessels@verisign.com">dwessels@verisign.com</a>&gt; Subject: \
[EXTERNAL] RE: in-addr.arpa spikes in DNS traffic<o:p></o:p> </div>
<div>
<o:p>&nbsp;</o:p>
</div>
We are seeing short bursts of PTR query traffic.&nbsp; Sources \
seem to be all open ISP resolvers scattered all over the United States.&nbsp; I host \
a bunch of in-addr.arpa zones from top level delegations and each of the queries \
appears to be for legitimate PTR records that we have defined.&nbsp; We typically \
receive about 7-10kpps (Packets Per Second) (not terribly large) and over the last \
week or two have received what seems like coordinated bursts of up and over \
200-400kpps of all PTR records.&nbsp; First observed in the United States – but \
today I learned our European based resolvers have also received similar spikes.&nbsp; \
My assumption was that if a bunch of ISP resolvers began receiving PTR queries for \
recursion – that the root servers might have seen an increase in folks asking what \
DNS servers to use for certain in-addr.arpa space at AT&amp;T.&nbsp; We have not seen \
a significant number of queries for arpa's that we are not authoritative for – it's \
an odd MO.<o:p></o:p> &nbsp;<o:p></o:p>
Thank you for taking the time to reply back.&nbsp; Is there any \
way to see if any of the other root-server providers have noticed anything of that \
sort?&nbsp; Im really grasping at straws at this point.<o:p></o:p> &nbsp;<o:p></o:p> <div>
Jeremy Monroe<o:p></o:p> Q Me <a \
href="qto://talk/jm9386">qto://talk/jm9386 \
</a><o:p></o:p> Senior - IT Network \
Design<o:p></o:p> Enterprise \
IP Services Support<o:p></o:p> AT&amp;T Services Inc \
– Network Cloud and Infrastructure Ops <o:p></o:p>
Intranet: <a \
href="http://eiss.it.att.com/">http://eiss.it.att.com</a> 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a \
href="http://eiss-dns.it.att.com/"> http://eiss-dns.it.att.com</a> 
573 204 5463 Skype/office<o:p></o:p> 314 235 8168 (AT&amp;T Domains voice \
mailbox)<o:p></o:p> <a \
href="mailto:3146508345@txt.att.net">3146508345@txt.att.net</a> Pager \
<o:p></o:p> 314 650 8345 Cell 
&quot;I \
don't know the secret to success, but the secret to failure is to try and please \
everyone&quot; <o:p></o:p>
 
&quot;This e-mail and any files transmitted with \
it are the property of at&amp;t, are confidential, and are intended solely for the \
use of the individual or entity to whom this e-mail is addressed. If you are not one \
of the named recipient or otherwise have reason to believe that you have received \
this message in error, please notify the sender at [jm9386@att.com or 314 235 8168] \
and delete this message immediately from your computer. Any other use, retention, \
dissemination, forwarding, printing, or copying of this e-mail is strictly \
prohibited.&quot;<o:p></o:p> </div>
&nbsp;<o:p></o:p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
From: Wessels, Duane &lt;<a \
href="mailto:dwessels@verisign.com">dwessels@verisign.com</a>&gt; 
Sent: Friday, December 21, 2018 15:37 
To: MONROE, JEREMY &lt;<a \
href="mailto:jm9386@att.com">jm9386@att.com</a>&gt; Subject: Re: \
in-addr.arpa spikes in DNS traffic<o:p></o:p> </div>
</div>
&nbsp;<o:p></o:p>
Jeremy,<o:p></o:p>
&nbsp;<o:p></o:p>
We don't see anything like that here.&nbsp; You mentioned both \
PTR and NS queries.&nbsp; Are you seeing both, or is it one or the other?&nbsp; \
<o:p></o:p> &nbsp;<o:p></o:p>
What you describe could be caused by availability issues with \
the lower levels of the DNS.&nbsp; Did you notice any similarities in the names being \
queried?<o:p></o:p> &nbsp;<o:p></o:p>
DW<o:p></o:p>
&nbsp;<o:p></o:p>
&nbsp;<o:p></o:p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
From: &quot;MONROE, JEREMY&quot; &lt;<a \
href="mailto:jm9386@att.com">jm9386@att.com</a>&gt; Date: Friday, December \
21, 2018 at 7:52 AM To: rootdns &lt;<a \
href="mailto:rootdns@verisign.com">rootdns@verisign.com</a>&gt; Subject: \
[EXTERNAL] in-addr.arpa spikes in DNS traffic<o:p></o:p> </div>
<div>
&nbsp;<o:p></o:p>
</div>
Hello – Im looking into a few network events where we received \
huge spikes in what appears to be valid PTR record lookups for zones to which we are \
authoritative for.&nbsp; Can you confirm whether or not the root servers have seen \
similar spikes in in-addr.arpa related NS queries?<o:p></o:p>
&nbsp;<o:p></o:p>
Jeremy Monroe<o:p></o:p> Q Me <a \
href="qto://talk/jm9386">qto://talk/jm9386 \
</a><o:p></o:p> Senior - IT Network \
Design<o:p></o:p> Enterprise \
IP Services Support<o:p></o:p> AT&amp;T Services Inc \
– Network Cloud and Infrastructure Ops <o:p></o:p>
Intranet: <a \
href="http://eiss.it.att.com/">http://eiss.it.att.com</a> 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a \
href="http://eiss-dns.it.att.com/"> http://eiss-dns.it.att.com</a> 
573 204 5463 Skype/office<o:p></o:p> 314 235 8168 (AT&amp;T Domains voice \
mailbox)<o:p></o:p> <a \
href="mailto:3146508345@txt.att.net">3146508345@txt.att.net</a> Pager \
<o:p></o:p> 314 650 8345 Cell 
&quot;I \
don't know the secret to success, but the secret to failure is to try and please \
everyone&quot; <o:p></o:p>
 
&quot;This e-mail and any files transmitted with \
it are the property of at&amp;t, are confidential, and are intended solely for the \
use of the individual or entity to whom this e-mail is addressed. If you are not one \
of the named recipient or otherwise have reason to believe that you have received \
this message in error, please notify the sender at [jm9386@att.com or 314 235 8168] \
and delete this message immediately from your computer. Any other use, retention, \
dissemination, forwarding, printing, or copying of this e-mail is strictly \
prohibited.&quot;<o:p></o:p> &nbsp;<o:p></o:p>
</div>
</div>
</blockquote></div></body>
</html>

_______________________________________________
dns-operations mailing list
dns-operations@lists.dns-oarc.net
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-operations mailing list
https://lists.dns-oarc.net/mailman/listinfo/dns-operations

[prev in list] [next in list] [prev in thread] [next in thread] 