Sunday, October 20, 2013

Domain: 43614.info

Domain: 43614.info

If you are seeing queries for this domain, than you are likely participating in DNS Amplification attacks and your DNS server is probably reachable from the internet and has recursion enabled.

If you are seeing responses for this domain.. unlucky. You are currently beeing DDOS-ed! Good luck.


IPtables:


There are two iptable rules available. If your distribution supports Iptables 'u32' module pick this one, otherwise use the 'string' rule.

U32:
iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28=0x05343336 && 0x2c&0xFFFFFFDF=0x31340449 && 0x30&0xDFDFDFFF=0x4e464f00" -j DROP -m comment --comment "DROP DNS Q 43614.info"

More U32 rules can be found here:

https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist.txt

String:
iptables --insert INPUT -p udp --dport 53 -m string --from 40 --to 52 --algo bm --hex-string '|05343336313404696e666f00|' -j DROP -m comment --comment "DROP DNS Q 43614.info"
More Iptables rules for the STRING module can be found here:


https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist-string.txt

Source:


No IP source for this domain

Name server:


;; ANSWER SECTION:
43614.info. 3600 IN NS ns65.domaincontrol.com.
43614.info. 3600 IN NS ns66.domaincontrol.com.

;; ADDITIONAL SECTION:
ns65.domaincontrol.com. 86400 IN A 216.69.185.43
ns65.domaincontrol.com. 86400 IN AAAA 2607:f208:206::2b


Response:


A 2
MX 2
NS 2
SOA 1
Rsize 209*

* Perhaps the domain is currently not active

Whois



Domain ID:D50794517-LRMS
Domain Name:43614.INFO
Created On:08-Oct-2013 08:05:47 UTC
Last Updated On:18-Oct-2013 20:46:42 UTC
Expiration Date:08-Oct-2014 08:05:47 UTC
Sponsoring Registrar:GoDaddy.com, LLC (R171-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:CR152354777
Registrant Name:edson edson
Registrant Organization:
Registrant Street1:beijing
Registrant Street2:
Registrant Street3:
Registrant City:beijing
Registrant State/Province:beijing
Registrant Postal Code:511111
Registrant Country:CN
Registrant Phone:+1.5555555555
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:afanti6@gmail.com
Admin ID:CR152354779
Admin Name:edson edson
Admin Organization:
Admin Street1:beijing
Admin Street2:
Admin Street3:
Admin City:beijing
Admin State/Province:beijing
Admin Postal Code:511111
Admin Country:CN
Admin Phone:+1.5555555555
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:afanti6@gmail.com
Billing ID:CR152354780
Billing Name:edson edson
Billing Organization:
Billing Street1:beijing
Billing Street2:
Billing Street3:
Billing City:beijing
Billing State/Province:beijing
Billing Postal Code:511111
Billing Country:CN
Billing Phone:+1.5555555555
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:afanti6@gmail.com
Tech ID:CR152354778
Tech Name:edson edson
Tech Organization:
Tech Street1:beijing
Tech Street2:
Tech Street3:
Tech City:beijing
Tech State/Province:beijing
Tech Postal Code:511111
Tech Country:CN
Tech Phone:+1.5555555555
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:afanti6@gmail.com
Name Server:NS66.DOMAINCONTROL.COM
Name Server:NS65.DOMAINCONTROL.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:





No comments:

Post a Comment