Full Disclosure mailing list archives
Mystery DNS Changes
From: "Hansen, Kevin" <kevin.hansen () thomson com>
Date: Wed, 1 Oct 2003 14:19:12 -0500
We have seen multiple instances where DHCP enabled workstations have had their DNS reconfigured to point to two of the three addresses listed below. Can anyone else confirm this? Incidents.org is reporting an increase in port 53 traffic over the last two days. Are we looking at the precursor to the next worm? 216.127.92.38 69.57.146.14 69.57.147.175 -KJH ++++++++++++++++++++++++++ Kevin J. Hansen Architect Global Network Thomson Legal & Regulatory kevin.hansen () thomson com 651-687-8466 ++++++++++++++++++++++++++
Current thread:
- Mystery DNS Changes Hansen, Kevin (Oct 01)
- Re: Mystery DNS Changes Gary Flynn (Oct 01)
- Re: Mystery DNS Changes Brian Eckman (Oct 01)
- Re: Mystery DNS Changes Russell Fulton (Oct 01)
- Re: Mystery DNS Changes Mary Landesman (Oct 01)
- Message not available
- Re: Mystery DNS Changes Mike Tancsa (Oct 01)
- Re: Mystery DNS Changes Gary Flynn (Oct 01)
- Re: Mystery DNS Changes Danny Pansters (Oct 01)
- Re: Mystery DNS Changes Joe Stewart (Oct 02)
- <Possible follow-ups>
- RE: Mystery DNS Changes Brown, James (Jim) (Oct 01)
- RE: Mystery DNS Changes Schmehl, Paul L (Oct 01)
- RE: Mystery DNS Changes David Vincent (Oct 01)