Domain: irlwinning.com

Scan and attacks for: irlwinning.com (In Real Life Winning .com) funny guy. He's probably 16.

Source IP seems to be a busy beaver.

IPtables:

There are two iptable rules available. If your distribution supports Iptables 'u32' module pick this one, otherwise use the 'string' rule.

U32:

iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x0a49524c && 0x2c&0xDFDFDFDF=0x57494e4e && 0x30&0xDFDFDFFF=0x494e4703 && 0x34&0xDFDFDFFF=0x434f4d00" -j DROP -m comment --comment "DROP DNS Q irlwinning.com"

More U32 rules can be found here:

https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist.txt


String:

iptables --insert INPUT -p udp --dport 53 -m string --from 40 --to 56 --algo bm --hex-string '|0A69726c77696e6e696e6703636f6d00|' -j DROP -m comment --comment "DROP DNS Q irlwinning.com"

More Iptables rules for the STRING module can be found here:

https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist-string.txt

Source:

80.82.65.204 - Ecatel

   2052 hizbullah.me
    431 bitstress.com
     80 8js44.xplodin.com
     59 hak4umz.net
      3 xplodin.com
      2 srvit.org
      1 directedat.asia
      1 anonsc.com

89.248.168.136 -  Ecatel

      4 theswat.net
      1 hizbullah.me

Name server:

irlwinning.com.         21600   IN      NS      ns1.irlwinning.com.
irlwinning.com.         21600   IN      NS      ns2.irlwinning.com.

;; ADDITIONAL SECTION:
ns2.irlwinning.com.     21600   IN      A       69.42.219.74
ns1.irlwinning.com.     21600   IN      A       69.42.219.74

Response:

243 A records in the 1.1.1.226

Whois

Domain irlwinning.com

Date Registered: 2013-10-1
Expiry Date: 2014-10-1

DNS1: ns1.irlwinning.com
DNS2: ns2.irlwinning.com

Registrant
    Fundacion Private Whois
    Domain Administrator
    Email:524b08137qidwx4b@5225b4d0pi3627q9.privatewhois.net
    Attn: irlwinning.com
    Aptds. 0850-00056
    Zona 15 Panama
    Panama
    Tel: +507.65995877

Administrative Contact
    Fundacion Private Whois
    Domain Administrator
    Email:524b0813sfmrmn27@5225b4d0pi3627q9.privatewhois.net
    Attn: irlwinning.com
    Aptds. 0850-00056
    Zona 15 Panama
    Panama
    Tel: +507.65995877

Technical Contact
    Fundacion Private Whois
    Domain Administrator
    Email:524b081301e20o65@5225b4d0pi3627q9.privatewhois.net
    Attn: irlwinning.com
    Aptds. 0850-00056
    Zona 15 Panama
    Panama
    Tel: +507.65995877

Registrar: Internet.bs Corp.
Registrar's Website : <a href='http://www.internetbs.net/'>http://www.internetbs.net/</a>