DNSサーバーへのDDoS 今回はamp

巨大なペイロードを持ったUDPパケットでbindを落とそうとするDNSサーバーへのDDoSが流行っているようですが、DNS ampのようです。

このドメインの

 deepholeforyou.info

TXTレコードに、こんな仕掛けがあります。

 ;; QUESTION SECTION:
 ;deepholeforyou.info.           IN      ANY
 
 ;; ANSWER SECTION:
 deepholeforyou.info.    357469  IN       TXT     "jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj"
 deepholeforyou.info.    357469  IN      TXT     "kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk"
 deepholeforyou.info.    357469  IN      TXT     "llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll"
 deepholeforyou.info.    357469  IN      TXT     "mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm"
 deepholeforyou.info.    357469  IN      TXT     "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn"
 deepholeforyou.info.    357469  IN      TXT     "oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo"
 deepholeforyou.info.    357469  IN      TXT     "pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
 deepholeforyou.info.    357469  IN      TXT     "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq"
 deepholeforyou.info.    357469  IN      TXT     "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr"
 deepholeforyou.info.    357469  IN      TXT     "ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss"
 deepholeforyou.info.    357469  IN      TXT     "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
 deepholeforyou.info.    357469  IN       TXT     "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
 deepholeforyou.info.    357469  IN      TXT     "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
 deepholeforyou.info.    357469  IN      TXT     "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
 deepholeforyou.info.    357469  IN      TXT     "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
 deepholeforyou.info.    357469  IN      TXT     "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
 deepholeforyou.info.    357469  IN      TXT     "gggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg"
 deepholeforyou.info.    357469  IN      TXT     "hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh"
 deepholeforyou.info.    357469  IN      TXT     "iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii"
 deepholeforyou.info.    357469  IN      NS      ns1.nsnoc.com.
 deepholeforyou.info.    357469  IN      NS      ns4.nsnoc.net.
 deepholeforyou.info.    357469  IN      NS      ns3.nsnoc.net.
 deepholeforyou.info.    357469  IN      NS      ns2.nsnoc.com.
 
 ;; AUTHORITY SECTION:
 deepholeforyou.info.    357469  IN      NS      ns3.nsnoc.net.
 deepholeforyou.info.    357469  IN      NS      ns4.nsnoc.net.
 deepholeforyou.info.    357469  IN      NS      ns1.nsnoc.com.
 deepholeforyou.info.    357469  IN      NS      ns2.nsnoc.com.
 
 ;; ADDITIONAL SECTION:
 ns1.nsnoc.com.          67999   IN      A       195.69.95.112
 ns2.nsnoc.com.          67999   IN      A       195.69.95.114
 

このクエリーの送出元は、こんなIPです。

 67.21.67.125
 207.218.247.135
 207.218.223.162 

たまに普通の端末IPが混ざっているのはなんでだろう、、、

[カテゴリ:DNS観察日記]

by jyake