Security Incidents mailing list archives

Re: massive unapproved AXFR's and odd rcvd NOTIFY's


From: francis () USLS EDU (Francis A. Vidal)
Date: Thu, 10 Feb 2000 12:26:40 +0800


---- Quoting Paul Wouters's message, sent 02/09/00 3:50pm ----

(All strings "domainname.com" are real domainnames)

I am seeing a LOT of these, even right now:

Feb 9 08:35:59 duplo named[543]: unapproved AXFR from
[216.0.52.138].1041 for "domainname.com" (acl)

same thing happened to me here -- exact IP addresses. most of the
queries were for AOL.COM. what i did was to block them at the router
level.

[some portion snipped]

--
francis vidal   university of st. la salle, bacolod city, philippines
. . . . . . .   PGP key available via e-mail / subject: get PGP key
u s l s N E T   tel nos. (+63.34).433.3526 / fax (+63.34).434.0415



Current thread: