If you are seeing queries for this domain, than you are likely participating in DNS Amplification attacks and your DNS server is probably reachable from the internet and has recursion enabled.
If you are seeing responses for this domain.. unlucky. You are currently beeing DDOS-ed! Good luck.
IPtables:
There are two iptable rules available. If your distribution supports Iptables 'u32' module pick this one, otherwise use the 'string' rule.
U32:
iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x08414855 && 0x2c&0xDFDFDFDF=0x59454855 && 0x30&0xDFFFDFDF=0x4504494e && 0x34&0xDFDFFF00=0x464f0000" -j DROP -m comment --comment "DROP DNS Q ahuyehue.info"
More U32 rules can be found here:
https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist.txt
String:
iptables --insert INPUT -p udp --dport 53 -m string --from 40 --to 55 --algo bm --hex-string '|08616875796568756504696e666f00|' -j DROP -m comment --comment "DROP DNS Q ahuyehue.info"
More Iptables rules for the STRING module can be found here:
https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist-string.txt
Source:
No IP source for this domain
Name server:
;; ANSWER SECTION:
ahuyehue.info. 10799 IN NS a.dns.gandi.net.
ahuyehue.info. 10799 IN NS b.dns.gandi.net.
ahuyehue.info. 10799 IN NS c.dns.gandi.net.
Response:
A 491
MX 2
NS 3
SOA 1
Rsize 8025
Whois
Domain Name:AHUYEHUE.INFO
Domain ID: D51782614-LRMS
Creation Date: 2014-02-25T22:17:32Z
Updated Date: 2014-02-25T22:17:34Z
Registry Expiry Date: 2015-02-25T22:17:32Z
Sponsoring Registrar:Gandi SAS (R191-LRMS)
Sponsoring Registrar IANA ID: 81
WHOIS Server:
Referral URL:
Domain Status: clientTransferProhibited
Domain Status: serverTransferProhibited
Registrant ID:MD8911-GANDI
Registrant Name:Maria Dietze
Registrant Organization:
Registrant Street: Whois Protege / Obfuscated whois
Registrant City:Paris
Registrant State/Province:
Registrant Postal Code:75013
Registrant Country:FR
Registrant Phone:+33.170377666
Registrant Phone Ext:
Registrant Fax: +33.143730576
Registrant Fax Ext:
Registrant Email:4b180cdd6569cf29910b55b359e2d81c-1863102@contact.gandi.net
Admin ID:MD8911-GANDI
Admin Name:Maria Dietze
Admin Organization:
Admin Street: Whois Protege / Obfuscated whois
Admin City:Paris
Admin State/Province:
Admin Postal Code:75013
Admin Country:FR
Admin Phone:+33.170377666
Admin Phone Ext:
Admin Fax: +33.143730576
Admin Fax Ext:
Admin Email:4b180cdd6569cf29910b55b359e2d81c-1863102@contact.gandi.net
Billing ID:MD8911-GANDI
Billing Name:Maria Dietze
Billing Organization:
Billing Street: Whois Protege / Obfuscated whois
Billing City:Paris
Billing State/Province:
Billing Postal Code:75013
Billing Country:FR
Billing Phone:+33.170377666
Billing Phone Ext:
Billing Fax: +33.143730576
Billing Fax Ext:
Billing Email:4b180cdd6569cf29910b55b359e2d81c-1863102@contact.gandi.net
Tech ID:MD8911-GANDI
Tech Name:Maria Dietze
Tech Organization:
Tech Street: Whois Protege / Obfuscated whois
Tech City:Paris
Tech State/Province:
Tech Postal Code:75013
Tech Country:FR
Tech Phone:+33.170377666
Tech Phone Ext:
Tech Fax: +33.143730576
Tech Fax Ext:
Tech Email:4b180cdd6569cf29910b55b359e2d81c-1863102@contact.gandi.net
Name Server:C.DNS.GANDI.NET
Name Server:B.DNS.GANDI.NET
Name Server:A.DNS.GANDI.NET
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC:Unsigned
Access to AFILIAS WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Afilias registry database. The data in this record is provided by Afilias Limited for informational purposes only, and Afilias does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to(a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator, a Registrar, or Afilias except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Afilias reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy.
This is a attacker ddoser
ReplyDelete