Friday, August 23, 2013

Domain: evgeniy-marchenko.cc

Seen attacks today with domain: evgeniy-marchenko.cc

Also happened to find the discovery packet for it!

Source:

80.82.70.239 AS29073 Ecatel Network

IPtables rule:


iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x11455647 && 0x2c&0xDFDFDFDF=0x454e4959 && 0x30&0xFFDFDFDF=0x2d4d4152 && 0x34&0xDFDFDFDF=0x4348454e && 0x38&0xDFDFFFDF=0x4b4f0243 && 0x3c&0xDFFFFFFF=0x43000001" -j DROP -m comment --comment "DROP DNS Q A evgeniy-marchenko.cc"

For more rules click here

Response:


240 A records in the 204.46.43.x range.

Name servers:

;; ANSWER SECTION:
evgeniy-marchenko.cc. 10800 IN NS a.dns.gandi.net.
evgeniy-marchenko.cc. 10800 IN NS b.dns.gandi.net.
evgeniy-marchenko.cc. 10800 IN NS c.dns.gandi.net.

;; ADDITIONAL SECTION:
c.dns.gandi.net. 86293 IN A 217.70.182.20
a.dns.gandi.net. 86293 IN A 173.246.97.2
b.dns.gandi.net. 86293 IN A 217.70.184.40


Tragets:



 165381  186.2.166.68 - PTR globalnet.pro-managed.com.
   61931  198.144.121.71
     7905  194.50.82.0
            1  80.82.70.239  <-- discovery IP.


Whois:

domain: evgeniy-marchenko.cc
reg_created: 2013-08-22 10:00:00
expires: 2014-08-22 10:00:00
created: 2013-08-22 12:00:00
changed: 2013-08-22 12:00:50
transfer-prohibited: yes
ns0: a.dns.gandi.net
ns1: b.dns.gandi.net
ns2: c.dns.gandi.net
owner-c:
  nic-hdl: SM9636-GANDI
  organisation: ~
  person: stelstelx@gmail.com massrek77
  obfuscated: Obfuscated by Gandi
  address: (Gandi) 63-65 boulevard Massena
  zipcode: (Gandi) 75013
  city: (Gandi) Paris
  country: (Gandi) France
  phone: (Gandi) +33.170377666
  fax: (Gandi) +33.143730576
  email: c1b35386b247e4ddaf5e7695b74eddea-1769297@contact.gandi.net
  lastupdated: 2013-08-22 11:32:25
admin-c:
  nic-hdl: SM9636-GANDI
  organisation: ~
  person: stelstelx@gmail.com massrek77
  obfuscated: Obfuscated by Gandi
  address: (Gandi) 63-65 boulevard Massena
  zipcode: (Gandi) 75013
  city: (Gandi) Paris
  country: (Gandi) France
  phone: (Gandi) +33.170377666
  fax: (Gandi) +33.143730576
  email: c1b35386b247e4ddaf5e7695b74eddea-1769297@contact.gandi.net
  lastupdated: 2013-08-22 11:32:25
tech-c:
  nic-hdl: SM9636-GANDI
  organisation: ~
  person: stelstelx@gmail.com massrek77
  obfuscated: Obfuscated by Gandi
  address: (Gandi) 63-65 boulevard Massena
  zipcode: (Gandi) 75013
  city: (Gandi) Paris
  country: (Gandi) France
  phone: (Gandi) +33.170377666
  fax: (Gandi) +33.143730576
  email: c1b35386b247e4ddaf5e7695b74eddea-1769297@contact.gandi.net
  lastupdated: 2013-08-22 11:32:25
bill-c:
  nic-hdl: SM9636-GANDI
  organisation: ~
  person: stelstelx@gmail.com massrek77
  obfuscated: Obfuscated by Gandi
  address: (Gandi) 63-65 boulevard Massena
  zipcode: (Gandi) 75013
  city: (Gandi) Paris
  country: (Gandi) France
  phone: (Gandi) +33.170377666
  fax: (Gandi) +33.143730576
  email: c1b35386b247e4ddaf5e7695b74eddea-1769297@contact.gandi.net
  lastupdated: 2013-08-22 11:32:25

No comments:

Post a Comment