Source:
Not observed myself.
Response:
About 255 A records in the 204.46.43.x range.IPtables rule:
iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x0a475241 && 0x2c&0xDFDFDFDF=0x50505942 && 0x30&0xDFDFDFFF=0x4c4f4703 && 0x34&0xDFDFDFFF=0x434f4d00" -j DROP -m comment --comment "DROP DNS Q grappyblog.com"More rules here
Name servers:
grappyblog.com. 10720 IN NS a.dns.gandi.net.grappyblog.com. 10720 IN NS c.dns.gandi.net.
grappyblog.com. 10720 IN NS b.dns.gandi.net.
;; ADDITIONAL SECTION:
b.dns.gandi.net. 86164 IN A 217.70.184.40
c.dns.gandi.net. 86164 IN A 217.70.182.20
c.dns.gandi.net. 86164 IN AAAA 2001:4b98:c:521::20
a.dns.gandi.net. 86164 IN AAAA 2604:3400:a::2
b.dns.gandi.net. 86164 IN AAAA 2001:4b98:b:a::40
a.dns.gandi.net. 86164 IN A 173.246.97.2
Whois:
domain: grappyblog.com
reg_created: 2013-06-13 09:30:21
expires: 2014-06-13 09:30:21
created: 2013-06-13 11:30:23
changed: 2013-09-22 14:52:54
transfer-prohibited: yes
ns0: a.dns.gandi.net
ns1: b.dns.gandi.net
ns2: c.dns.gandi.net
owner-c:
nic-hdl: CKV4-GANDI
organisation: ~
person: charlotte karila vaillant
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 7cbec7cb44a69cc598cc257f51c3604e-1728756@contact.gandi.net
lastupdated: 2013-06-04 20:18:53
admin-c:
nic-hdl: CKV4-GANDI
organisation: ~
person: charlotte karila vaillant
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 7cbec7cb44a69cc598cc257f51c3604e-1728756@contact.gandi.net
lastupdated: 2013-06-04 20:18:53
tech-c:
nic-hdl: CKV4-GANDI
organisation: ~
person: charlotte karila vaillant
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 7cbec7cb44a69cc598cc257f51c3604e-1728756@contact.gandi.net
lastupdated: 2013-06-04 20:18:53
bill-c:
nic-hdl: CKV4-GANDI
organisation: ~
person: charlotte karila vaillant
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 7cbec7cb44a69cc598cc257f51c3604e-1728756@contact.gandi.net
lastupdated: 2013-06-04 20:18:53
Observing this attack hard and heavy today in our Dallas DC.
ReplyDelete