[Current] Persistent DNS Zone Transfer Attempts

Jon R. Kibler Jon.Kibler at aset.com
Sat Jun 26 14:59:09 UTC 2004


Greetings,

Anyone know anything about IP 128.232.0.31?
> # host 128.232.0.31
> 31.0.232.128.in-addr.arpa domain name pointer dns-probe.srg.cl.cam.ac.uk.
> 

We have been getting persistent zone transfer attempts that originate from this IP address. We have had repeated zone transfer attempts against all of our DNS zones -- and against all 7 name servers that we manage. This has been going on now for about 2 or 3 weeks -- more or less. Recently, we have also seen attempts to do zone transfers for non-authoritative domains. Logging shows that this IP apparently never attempts to make legitimate DNS queries, only zone transfers.

Anyone know anything about this IP?

Anyone else have the appropriate logging enabled and also seeing this IP make zone transfer attempts?

Thoughts/comments/suggestions?

Thanks!
Jon
-- 
Jon R. Kibler
Chief Technical Officer
A.S.E.T., Inc.
Charleston, SC  USA
(843) 849-8214




==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.



More information about the Current mailing list