[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
d6991.com traffic
- Subject: d6991.com traffic
- From: rdobbins at arbor.net (Dobbins, Roland)
- Date: Mon, 23 Sep 2013 17:25:02 +0000
- In-reply-to: <[email protected]>
- References: <CAP+vuLXX8UOE8NSB3ht5L-Rj-kfMhmHmXimojPv6qG=wD7449w@mail.gmail.com> <[email protected]> <[email protected]>
On Sep 24, 2013, at 12:11 AM, Chris Hunt wrote:
> That is a problem, but I'm seeing a lot of queries from residential users for what seems to me an obscure name hostied in Asia. I'm
> guessing some kind of bot traffic...
They may be open recursors being leveraged for DNS reflection/amplification DDoS (many CPE devices are broken this way). Check some of the CPEs to see if they're open recursors:
<http://openresolverproject.org/>
-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
Luck is the residue of opportunity and design.
-- John Milton