Also happened to find the discovery packet for it!
Source:
80.82.70.239 AS29073 Ecatel NetworkIPtables rule:
iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x11455647 && 0x2c&0xDFDFDFDF=0x454e4959 && 0x30&0xFFDFDFDF=0x2d4d4152 && 0x34&0xDFDFDFDF=0x4348454e && 0x38&0xDFDFFFDF=0x4b4f0243 && 0x3c&0xDFFFFFFF=0x43000001" -j DROP -m comment --comment "DROP DNS Q A evgeniy-marchenko.cc"
For more rules click here
Response:
240 A records in the 204.46.43.x range.
Name servers:
;; ANSWER SECTION:evgeniy-marchenko.cc. 10800 IN NS a.dns.gandi.net.
evgeniy-marchenko.cc. 10800 IN NS b.dns.gandi.net.
evgeniy-marchenko.cc. 10800 IN NS c.dns.gandi.net.
;; ADDITIONAL SECTION:
c.dns.gandi.net. 86293 IN A 217.70.182.20
a.dns.gandi.net. 86293 IN A 173.246.97.2
b.dns.gandi.net. 86293 IN A 217.70.184.40
Tragets:
165381 186.2.166.68 - PTR globalnet.pro-managed.com.
61931 198.144.121.71
7905 194.50.82.0
1 80.82.70.239 <-- discovery IP.
Whois:
domain: evgeniy-marchenko.cc
reg_created: 2013-08-22 10:00:00
expires: 2014-08-22 10:00:00
created: 2013-08-22 12:00:00
changed: 2013-08-22 12:00:50
transfer-prohibited: yes
ns0: a.dns.gandi.net
ns1: b.dns.gandi.net
ns2: c.dns.gandi.net
owner-c:
nic-hdl: SM9636-GANDI
organisation: ~
person: stelstelx@gmail.com massrek77
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: c1b35386b247e4ddaf5e7695b74eddea-1769297@contact.gandi.net
lastupdated: 2013-08-22 11:32:25
admin-c:
nic-hdl: SM9636-GANDI
organisation: ~
person: stelstelx@gmail.com massrek77
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: c1b35386b247e4ddaf5e7695b74eddea-1769297@contact.gandi.net
lastupdated: 2013-08-22 11:32:25
tech-c:
nic-hdl: SM9636-GANDI
organisation: ~
person: stelstelx@gmail.com massrek77
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: c1b35386b247e4ddaf5e7695b74eddea-1769297@contact.gandi.net
lastupdated: 2013-08-22 11:32:25
bill-c:
nic-hdl: SM9636-GANDI
organisation: ~
person: stelstelx@gmail.com massrek77
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: c1b35386b247e4ddaf5e7695b74eddea-1769297@contact.gandi.net
lastupdated: 2013-08-22 11:32:25
No comments:
Post a Comment