If you are seeing queries for this domain, than you are likely participating in DNS Amplification attacks and your DNS server is probably reachable from the internet and has recursion enabled.
If you are seeing responses for this domain.. unlucky. You are currently beeing DDOS-ed! Good luck.
IPtables:
There are two iptable rules available. If your distribution supports Iptables 'u32' module pick this one, otherwise use the 'string' rule.
U32:
iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x06444546 && 0x2c&0xDFDFDFFF=0x434f4e03 && 0x30&0xDFDFDFFF=0x4f524700 && 0x34&0xFFFF0000=0x00FF0000" -j DROP -m comment --comment "DROP DNS Q defcon.org"
More U32 rules can be found here:
https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist.txt
String:
iptables --insert INPUT -p udp --dport 53 -m string --from 40 --to 54 --algo bm --hex-string '|06646566636f6e036f72670000ff|' -j DROP -m comment --comment "DROP DNS Q defcon.org"
More Iptables rules for the STRING module can be found here:
https://github.com/smurfmonitor/dns-iptables-rules/blob/master/domain-blacklist-string.txt
Source:
No IP source for this domain
Name server:
;; ANSWER SECTION:
defcon.org. 17330 IN NS dns-2.datamerica.com.
defcon.org. 17330 IN NS dns-1.datamerica.com.
Response:
A 14
DNSKEY 5
MX 3
NS 9
NSEC 2
RRSIG 10
SOA 3
SPF 3
TXT 3
Rsize 4084
Whois
Domain Name:DEFCON.ORG
Domain ID: D1826-LROR
Creation Date: 1993-06-21T04:00:00Z
Updated Date: 2014-04-21T08:27:45Z
Registry Expiry Date: 2017-06-20T04:00:00Z
Sponsoring Registrar:Network Solutions, LLC (R63-LROR)
Sponsoring Registrar IANA ID: 2
WHOIS Server:
Referral URL:
Domain Status: clientTransferProhibited
Registrant ID:51671423-NSIV
Registrant Name:Perfect Privacy, LLC
Registrant Organization:DEF CON Communications, Inc.
Registrant Street: 12808 Gran Bay Parkway West
Registrant Street: care of Network Solutions
Registrant Street: PO Box 459
Registrant City:Jacksonville
Registrant State/Province:FL
Registrant Postal Code:32258
Registrant Country:US
Registrant Phone:+1.5707088780
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email:ua7cc74z6fh@networksolutionsprivateregistration.com
Admin ID:43296585-NSIV
Admin Name:Perfect Privacy, LLC
Admin Organization:
Admin Street: 12808 Gran Bay Parkway West
Admin Street: care of Network Solutions
Admin City:Jacksonville
Admin State/Province:FL
Admin Postal Code:32258
Admin Country:US
Admin Phone:+1.5707088780
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email:rv4hu2bx2d2@networksolutionsprivateregistration.com
Tech ID:43296585-NSIV
Tech Name:Perfect Privacy, LLC
Tech Organization:
Tech Street: 12808 Gran Bay Parkway West
Tech Street: care of Network Solutions
Tech City:Jacksonville
Tech State/Province:FL
Tech Postal Code:32258
Tech Country:US
Tech Phone:+1.5707088780
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email:rv4hu2bx2d2@networksolutionsprivateregistration.com
Name Server:DNS-2.DATAMERICA.COM
Name Server:DNS-1.DATAMERICA.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC:signedDelegation
DS Created 1:2011-07-08T13:14:45Z
DS Key Tag 1:59611
Algorithm 1:5
Digest Type 1:1
Digest 1:07BCC192690AEE10148C5E6AB38995FE0A2A4B3D
DS Maximum Signature Life 1:1814400 seconds
DS Created 2:2011-07-08T13:15:14Z
DS Key Tag 2:59611
Algorithm 2:5
Digest Type 2:2
Digest 2:15B567E4743D993B923507926CDA709611F335A1D0A7D38456EE12E5D16375B7
DS Maximum Signature Life 2:1814400 seconds
Access to Public Interest Registry WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Public Interest Registry registry database. The data in this record is provided by Public Interest Registry for informational purposes only, and Public Interest Registry does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to(a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator, a Registrar, or Afilias except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Public Interest Registry reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy.
