Re: Rogue DNS Servers

[Jeff Kell <jeff-kell () utc edu>]

Fergie wrote:
> Researchers of Trend Micro have identified a network of more than 115 rogue
> DNS servers that are used by a certain variant of TROJ_DNSCHANG. These DNS
> servers exhibit interesting behavior. 

I get timeouts trying to reference the URL, so I can't get the 
details... but...

If you're talking about the Inhoster hooks, this has been going on for 
months.  DNS clients are hijacked to point to various servers in 
85.255.112.0/20.

Recently (last 48 hours) I've seen enduser queries out of our block 
(excluding our internal recursive servers) directed toward...

>  < Dst IP address >  	 < Total # > 
>   85.255.112.116   	1420
>   85.255.112.183        3
>   85.255.116.53         1940
>   85.255.116.168        3

I don't see any other "out of the ordinary" outbound DNS, at least not 
clustered
Jeff

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.