lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: frank at knobbe.us (Frank Knobbe)
Subject: FW: Question for DNS pros

On Tue, 2004-08-03 at 17:52, Frank Knobbe wrote:

> 216.154.239.240 - SBC in Irvine
  --> couldn't confirm that one
> 66.150.165.7 - Logical US-AWS NAP through Internap
  --> seadns01.shopattwireless.com (match)
> 64.170.177.10 - SBC Interactive through PacBell
  --> 64-170-177-10.ptim.com (match)
> 63.240.26.10 - CERFnet
  --> ny-ns.marketwatch.com (match)
> 63.210.252.135 - Level 3
  --> cindns01.shopattwireless.com (match)

(match means it is the exact same traffic, just a low volume, between 3
and 10 packets total).

It appears all these are DNS servers. They also all respond to queries
for "." with the list of root servers. That means that they are
recursive.

Perhaps there is a 0-day exploit for certain DNS servers? Maybe those
DNS servers have a worm that is trying to spread? Maybe seeded from
China? Otherwise, why would AT&T's name server be sending out probes?

The mystery deepens...

Regards,
Frank


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040803/a877c938/attachment.bin

Powered by blists - more mailing lists