Re: d6991.com traffic

["Dobbins, Roland" <rdobbins () arbor net>]

On Sep 24, 2013, at 12:11 AM, Chris Hunt wrote:

> That is a problem, but I'm seeing a lot of queries from residential users for what seems to me an obscure name 
> hostied in Asia.  I'm
> guessing some kind of bot traffic...

They may be open recursors being leveraged for DNS reflection/amplification DDoS (many CPE devices are broken this 
way).  Check some of the CPEs to see if they're open recursors:

<http://openresolverproject.org/>

-----------------------------------------------------------------------
Roland Dobbins <rdobbins () arbor net> // <http://www.arbornetworks.com>

          Luck is the residue of opportunity and design.

                       -- John Milton