[FR] 89.93.107.1 - AS5410

General Information:

Attacked IP: 89.93.107.1
Country: France

Start: 2013-05-17 15:28:42
End: 2013-05-17 15:36:35
Duration: 7 minute(s)
Average query rate: 288 per minute

Requested DNS record: isc.org
Query count: 2017

IPrange: 89.80.0.0/12
AS Number: Bouygues Telecom ISP
ISP: AS5410

IP has a reverse DNS value of: 89-93-107-1.hfc.dyn.abo.bbox.fr

This IP was only seen today

Observed 1 attack:

• Attack 1 from 15:00 till 16:00

Details of the DNS Amplification attack:


Requested DNS record: isc.org
Query count: 2017

Start: 2013-05-17 15:28:42
End: 2013-05-17 15:36:35
Duration: 7 minute(s)
Average query rate: 288 per minute

All request were made with the DNS id: 0x1d42 / 7490

Average query size: 78 bytes
Average response size: 325 bytes

Amplification: 316%

Total query size: 157326 bytes / 153 kilobytes
Response size: 655525 bytes / 640 kilobytes
TotalBandwidth: 812851 bytes / 793 kilobytes

All observed queries were made with a TTL of: 106

Because of this I think the attack was most likely performed from a single host rather than by a botnet.

All request were made with a UDP source port of: 26060

>>Read Before Rage<<<