Tuesday, September 24, 2013

Domain: grappyblog.com

Received a tip!

Source:

Not observed myself.

Response:

About 255 A records in the 204.46.43.x range.


IPtables rule:

iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x0a475241 && 0x2c&0xDFDFDFDF=0x50505942 && 0x30&0xDFDFDFFF=0x4c4f4703 && 0x34&0xDFDFDFFF=0x434f4d00" -j DROP -m comment --comment "DROP DNS Q grappyblog.com"

More rules here

Name servers:

grappyblog.com.         10720   IN      NS      a.dns.gandi.net.
grappyblog.com.         10720   IN      NS      c.dns.gandi.net.
grappyblog.com.         10720   IN      NS      b.dns.gandi.net.

;; ADDITIONAL SECTION:
b.dns.gandi.net.        86164   IN      A       217.70.184.40
c.dns.gandi.net.        86164   IN      A       217.70.182.20
c.dns.gandi.net.        86164   IN      AAAA    2001:4b98:c:521::20
a.dns.gandi.net.        86164   IN      AAAA    2604:3400:a::2
b.dns.gandi.net.        86164   IN      AAAA    2001:4b98:b:a::40
a.dns.gandi.net.        86164   IN      A       173.246.97.2

Whois:

domain: grappyblog.com
reg_created: 2013-06-13 09:30:21
expires: 2014-06-13 09:30:21
created: 2013-06-13 11:30:23
changed: 2013-09-22 14:52:54
transfer-prohibited: yes
ns0: a.dns.gandi.net
ns1: b.dns.gandi.net
ns2: c.dns.gandi.net
owner-c:
  nic-hdl: CKV4-GANDI
  organisation: ~
  person: charlotte karila vaillant
  obfuscated: Obfuscated by Gandi
  address: (Gandi) 63-65 boulevard Massena
  zipcode: (Gandi) 75013
  city: (Gandi) Paris
  country: (Gandi) France
  phone: (Gandi) +33.170377666
  fax: (Gandi) +33.143730576
  email: 7cbec7cb44a69cc598cc257f51c3604e-1728756@contact.gandi.net
  lastupdated: 2013-06-04 20:18:53
admin-c:
  nic-hdl: CKV4-GANDI
  organisation: ~
  person: charlotte karila vaillant
  obfuscated: Obfuscated by Gandi
  address: (Gandi) 63-65 boulevard Massena
  zipcode: (Gandi) 75013
  city: (Gandi) Paris
  country: (Gandi) France
  phone: (Gandi) +33.170377666
  fax: (Gandi) +33.143730576
  email: 7cbec7cb44a69cc598cc257f51c3604e-1728756@contact.gandi.net
  lastupdated: 2013-06-04 20:18:53
tech-c:
  nic-hdl: CKV4-GANDI
  organisation: ~
  person: charlotte karila vaillant
  obfuscated: Obfuscated by Gandi
  address: (Gandi) 63-65 boulevard Massena
  zipcode: (Gandi) 75013
  city: (Gandi) Paris
  country: (Gandi) France
  phone: (Gandi) +33.170377666
  fax: (Gandi) +33.143730576
  email: 7cbec7cb44a69cc598cc257f51c3604e-1728756@contact.gandi.net
  lastupdated: 2013-06-04 20:18:53
bill-c:
  nic-hdl: CKV4-GANDI
  organisation: ~
  person: charlotte karila vaillant
  obfuscated: Obfuscated by Gandi
  address: (Gandi) 63-65 boulevard Massena
  zipcode: (Gandi) 75013
  city: (Gandi) Paris
  country: (Gandi) France
  phone: (Gandi) +33.170377666
  fax: (Gandi) +33.143730576
  email: 7cbec7cb44a69cc598cc257f51c3604e-1728756@contact.gandi.net
  lastupdated: 2013-06-04 20:18:53

1 comment:

  1. Observing this attack hard and heavy today in our Dallas DC.

    ReplyDelete