IPtables:
iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x0a5a4149 && 0x2c&0xDFDFDFDF=0x4b415041 && 0x30&0xDFDFDFFF=0x494b4103 && 0x34&0xDFDFDFFF=0x434f4d00" -j DROP -m comment --comment "DROP DNS Q zaikapaika.com"
Source:
89.248.174.54 - Ecatel (everytime)
Also seen this IP for:
kiddy3233655.ru
Name server:
zaikapaika.com. 10800 IN NS b.dns.gandi.net.
zaikapaika.com. 10800 IN NS a.dns.gandi.net.
zaikapaika.com. 10800 IN NS c.dns.gandi.net.
;; ADDITIONAL SECTION:
c.dns.gandi.net. 85933 IN AAAA 2001:4b98:c:521::20
b.dns.gandi.net. 85933 IN AAAA 2001:4b98:b:a::40
a.dns.gandi.net. 85933 IN AAAA 2604:3400:a::2
a.dns.gandi.net. 85933 IN A 173.246.97.2
b.dns.gandi.net. 85933 IN A 217.70.184.40
c.dns.gandi.net. 85933 IN A 217.70.182.20
Response:
241 A records in the 204.46.43.x range.
Whois
domain: zaikapaika.comreg_created: 2013-09-23 08:41:35
expires: 2014-09-23 08:41:35
created: 2013-09-23 10:41:36
changed: 2013-09-26 22:32:45
transfer-prohibited: yes
ns0: a.dns.gandi.net
ns1: b.dns.gandi.net
ns2: c.dns.gandi.net
owner-c:
nic-hdl: VV1405-GANDI
organisation: ~
person: Vyacheslav Volkov
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 5e2223699a84baf9c6365442bfa79494-1782482@contact.gandi.net
lastupdated: 2013-09-20 18:00:18
admin-c:
nic-hdl: VV1405-GANDI
organisation: ~
person: Vyacheslav Volkov
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 5e2223699a84baf9c6365442bfa79494-1782482@contact.gandi.net
lastupdated: 2013-09-20 18:00:18
tech-c:
nic-hdl: VV1405-GANDI
organisation: ~
person: Vyacheslav Volkov
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 5e2223699a84baf9c6365442bfa79494-1782482@contact.gandi.net
lastupdated: 2013-09-20 18:00:18
bill-c:
nic-hdl: VV1405-GANDI
organisation: ~
person: Vyacheslav Volkov
obfuscated: Obfuscated by Gandi
address: (Gandi) 63-65 boulevard Massena
zipcode: (Gandi) 75013
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 5e2223699a84baf9c6365442bfa79494-1782482@contact.gandi.net
lastupdated: 2013-09-20 18:00:18
Hitting us hard and heavy in the EU
ReplyDelete