2009-01-17

DNS... WTF?

Jan 17 13:53:33 [named] client 69.50.142.11#8500: query (cache) './NS/IN' denied
Jan 17 13:53:34 [named] client 69.50.142.11#62054: query (cache) './NS/IN' denied
Jan 17 13:53:34 [named] client 69.50.142.11#50405: query (cache) './NS/IN' denied
Jan 17 13:53:37 [named] client 69.50.142.11#38682: query (cache) './NS/IN' denied
Jan 17 13:53:39 [named] client 69.50.142.11#47266: query (cache) './NS/IN' denied

# bzgrep -l "client 69.50.142.11#" log-2009-*.bz2
log-2009-01-08-14:01:54.bz2
log-2009-01-16-20:01:54.bz2
log-2009-01-16-23:01:42.bz2
log-2009-01-17-02:01:49.bz2
log-2009-01-17-05:01:55.bz2
log-2009-01-17-08:01:50.bz2
log-2009-01-17-11:01:04.bz2
# bzgrep "client 69.50.142.11#" log-2009-*.bz2 | wc -l
33464
#

Update
I got a quick answer from their hosting company. According to them, the source IP is fake and this is a DOS.
Rather lame, IMHO: a DNS answer is small. If the cracker can fake the source IP, he can directly flood the victim with more data than my DNS server...

Labels: ,