[FR] 62.147.132.163 - AS12322

General Information:

Attacked IP: 62.147.132.163
Country: France

Start: 2013-05-18 00:53:27
End: 2013-05-18 00:56:35
Duration: 3 minute(s)
Average query rate: 170 per minute

Requested DNS record: isc.org
Query count: 510

IPrange: 62.147.0.0/16
AS Number: Paris, France
ISP: AS12322

IP has a reverse DNS value of: lns-bzn-47f-62-147-132-163.adsl.proxad.net

This IP was only seen today

Observed 1 attack:

• Attack 1 from 0:00 till 1:00

Details of the DNS Amplification attack:


Requested DNS record: isc.org
Query count: 510

Start: 2013-05-18 00:53:27
End: 2013-05-18 00:56:35
Duration: 3 minute(s)
Average query rate: 170 per minute

All request were made with the DNS id: 0x1d42 / 7490

Average query size: 78 bytes
Average response size: 612 bytes

Amplification: 684%

Total query size: 39780 bytes / 38 kilobytes
Response size: 312120 bytes / 304 kilobytes
TotalBandwidth: 351900 bytes / 343 kilobytes

All observed queries were made with a TTL of: 106

Because of this I think the attack was most likely performed from a single host rather than by a botnet.

All request were made with a UDP source port of: 49940

>>Read Before Rage<<<