If you are seeing queries for this domain, than you are likely participating in DNS Amplification attacks and your DNS server is probably reachable from the internet and has recursion enabled.
If you are seeing responses for this domain.. unlucky. You are currently beeing DDOS-ed! Good luck.
IPtables:
There are two iptable rules available. If your distribution supports Iptables 'u32' module pick this one, otherwise use the 'string' rule.
U32:
iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28=0x05363732 && 0x2c&0xFFFFFFDF=0x35320449 && 0x30&0xDFDFDFFF=0x4e464f00" -j DROP -m comment --comment "DROP DNS Q 67252.info"
More U32 rules can be found here:
https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist.txt
String:
iptables --insert INPUT -p udp --dport 53 -m string --from 40 --to 52 --algo bm --hex-string '|05363732353204696e666f00|' -j DROP -m comment --comment "DROP DNS Q 67252.info"
More Iptables rules for the STRING module can be found here:
https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist-string.txt
Source:
122.136.196.116
Name server:
;; ANSWER SECTION:
67252.info. 3600 IN NS ns66.domaincontrol.com.
67252.info. 3600 IN NS ns65.domaincontrol.com.
;; ADDITIONAL SECTION:
ns65.domaincontrol.com. 86400 IN A 216.69.185.43
ns65.domaincontrol.com. 86400 IN AAAA 2607:f208:206::2b
ns66.domaincontrol.com. 86400 IN A 208.109.255.43
ns66.domaincontrol.com. 86400 IN AAAA 2607:f208:302::2b
Response:
A 2
MX 2
NS 2
SOA 1
Rsize 209
Whois
Domain ID:D50794526-LRMS
Domain Name:67252.INFO
Created On:08-Oct-2013 08:05:47 UTC
Last Updated On:18-Oct-2013 20:46:41 UTC
Expiration Date:08-Oct-2014 08:05:47 UTC
Sponsoring Registrar:GoDaddy.com, LLC (R171-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:CR152354785
Registrant Name:edson edson
Registrant Organization:
Registrant Street1:beijing
Registrant Street2:
Registrant Street3:
Registrant City:beijing
Registrant State/Province:beijing
Registrant Postal Code:511111
Registrant Country:CN
Registrant Phone:+1.5555555555
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:afanti6@gmail.com
Admin ID:CR152354787
Admin Name:edson edson
Admin Organization:
Admin Street1:beijing
Admin Street2:
Admin Street3:
Admin City:beijing
Admin State/Province:beijing
Admin Postal Code:511111
Admin Country:CN
Admin Phone:+1.5555555555
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:afanti6@gmail.com
Billing ID:CR152354788
Billing Name:edson edson
Billing Organization:
Billing Street1:beijing
Billing Street2:
Billing Street3:
Billing City:beijing
Billing State/Province:beijing
Billing Postal Code:511111
Billing Country:CN
Billing Phone:+1.5555555555
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:afanti6@gmail.com
Tech ID:CR152354786
Tech Name:edson edson
Tech Organization:
Tech Street1:beijing
Tech Street2:
Tech Street3:
Tech City:beijing
Tech State/Province:beijing
Tech Postal Code:511111
Tech Country:CN
Tech Phone:+1.5555555555
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:afanti6@gmail.com
Name Server:NS66.DOMAINCONTROL.COM
Name Server:NS65.DOMAINCONTROL.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
also eschenemnogo.com
ReplyDelete