Saturday, June 28, 2014



If you are seeing queries for this domain, than you are likely participating in DNS Amplification attacks and your DNS server is probably reachable from the internet and has recursion enabled.

If you are seeing responses for this domain.. unlucky. You are currently beeing DDOS-ed! Good luck.


There are two iptable rules available. If your distribution supports Iptables 'u32' module pick this one, otherwise use the 'string' rule.

iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x0842414e && 0x2c&0xDFDFDFDF=0x47544553 && 0x30&0xDFFFDFDF=0x54045a4f && 0x34&0xDFDFFFDF=0x4e470243 && 0x38&0xDFFFDFDF=0x4f025541 && 0x3c&0xFF000000=0x00000000" -j DROP -m comment --comment "DROP DNS Q"

More U32 rules can be found here:

iptables --insert INPUT -p udp --dport 53 -m string --from 40 --to 61 --algo bm --hex-string '|0862616e6774657374047a6f6e6702636f02756100|' -j DROP -m comment --comment "DROP DNS Q"
More Iptables rules for the STRING module can be found here:


Name server:

;; ANSWER SECTION: 21599 IN NS 21599 IN NS


Domain ID:589099_COUA-DRS
Domain Name:ZONG.CO.UA
Created On:07-Jan-2014 14:31:16 UTC
Last Updated On:04-Jun-2014 17:07:50 UTC
Expiration Date:07-Jan-2015 14:31:16 UTC
Sponsoring Registrar:Reg RU (reg-ru-mnt-cunic)
Registrant ID:O8402055-CUNIC
Registrant Name:
Registrant Organization:Private Person
Registrant Street1:
Registrant Street2:
Registrant Street3:
Registrant City:
Registrant State/Province:
Registrant Postal Code:
Registrant Country:
Registrant Phone:+61.420500569
Registrant Fax:
Admin ID:A8402055-CUNIC
Admin Name:
Admin Organization:Private Person
Admin Street1:
Admin Street2:
Admin Street3:
Admin City:
Admin State/Province:
Admin Postal Code:
Admin Country:
Admin Phone:+61.420500569
Admin Fax:
Billing ID:B8402055-CUNIC
Billing Name:
Billing Organization:Private Person
Billing Street1:
Billing Street2:
Billing Street3:
Billing City:
Billing State/Province:
Billing Postal Code:
Billing Country:
Billing Phone:+61.420500569
Billing Fax:
Tech ID:T8402055-CUNIC
Tech Name:
Tech Organization:Private Person
Tech Street1:
Tech Street2:
Tech Street3:
Tech City:
Tech State/Province:
Tech Postal Code:
Tech Country:
Tech Phone:+61.420500569
Tech Fax:
Name Server:NS2.REG.RU
Name Server:NS1.REG.RU

No comments:

Post a Comment