(no subject)

[Mike Bugden]

Esteemed Bind list members,

Over the last couple of weeks I have been seeing
Unapproved zone transfers show up in my logs. This in
itself is not that strange, what is strange however is
that:

a) they are always trying to access the same two zones
(even though I have many more than that)
b) they are random times of the day and have random
intervals between tries
c) each group of attempts is from a different source
address

I am assuming this is one person spoofing addresses,
but what are they trying to do?

Or is someone just messing with my head.

Mike

Excerpt of log file.

Jan 10 00:44:38 ns named[117]: unapproved AXFR from
[203.26.36.17].1490 for "1st.domain.com" (acl)
Jan 10 02:24:55 ns named[117]: unapproved AXFR from
[203.26.36.17].2786 for "2nd.domain.com" (acl)
Jan 10 13:38:34 ns named[117]: unapproved AXFR from
[209.112.56.46].2621 for "1st.domain.com" (acl)
Jan 10 17:44:18 ns named[117]: unapproved AXFR from
[209.112.56.46].3598 for "2nd.domain.com" (acl)
Jan 10 19:21:36 ns named[117]: unapproved AXFR from
[203.21.133.178].29860 for "1st.domain.com" (acl)
Jan 11 06:20:40 ns named[117]: unapproved AXFR from
[149.156.130.133].33963 for "1st.domain.com" (acl)
Jan 11 13:35:27 ns named[117]: unapproved AXFR from
[149.156.130.133].34443 for "2nd.domain.com" (acl)
Jan 11 21:55:52 ns named[117]: unapproved AXFR from
[216.233.42.99].1135 for "1st.domain.com" (acl)
Jan 12 16:39:02 ns named[117]: unapproved AXFR from
[24.188.15.218].45098 for "1st.domain.com" (acl)
Jan 12 16:39:24 ns named[117]: unapproved AXFR from
[24.188.15.218].45385 for "1st.domain.com" (acl)
Jan 12 16:40:23 ns named[117]: unapproved AXFR from
[24.188.15.218].45675 for "1st.domain.com" (acl)
Jan 12 16:40:30 ns named[117]: unapproved AXFR from
[24.188.15.218].45704 for "1st.domain.com" (acl)
Jan 12 16:40:57 ns named[117]: unapproved AXFR from
[24.188.15.218].45817 for "1st.domain.com" (acl)
Jan 12 20:50:00 ns named[117]: unapproved AXFR from
[24.188.15.218].43531 for "2nd.domain.com" (acl)
Jan 12 20:50:03 ns named[117]: unapproved AXFR from
[24.188.15.218].43543 for "2nd.domain.com" (acl)
Jan 12 20:50:19 ns named[117]: unapproved AXFR from
[24.188.15.218].43597 for "2nd.domain.com" (acl)
Jan 12 20:52:18 ns named[117]: unapproved AXFR from
[24.188.15.218].43873 for "2nd.domain.com" (acl)
Jan 12 20:52:45 ns named[117]: unapproved AXFR from
[24.188.15.218].43948 for "2nd.domain.com" (acl)
Jan 12 23:10:19 ns named[117]: unapproved AXFR from
[24.188.15.218].38088 for "1st.domain.com" (acl)
Jan 13 10:47:19 ns named[117]: unapproved AXFR from
[129.15.98.55].1304 for "1st.domain.com" (acl)
Jan 13 15:28:15 ns named[117]: unapproved AXFR from
[129.15.98.55].1856 for "2nd.domain.com" (acl)
Jan 14 01:23:19 ns named[117]: unapproved AXFR from
[129.15.98.55].2317 for "1st.domain.com" (acl)
Jan 14 04:57:12 ns named[117]: unapproved AXFR from
[203.166.224.7].17386 for "1st.domain.com" (acl)
Jan 14 05:11:14 ns named[117]: unapproved AXFR from
[203.166.224.7].18802 for "1st.domain.com" (acl)
Jan 14 06:57:12 ns named[117]: unapproved AXFR from
[203.166.224.7].9901 for "2nd.domain.com" (acl)
Jan 14 06:59:34 ns named[117]: unapproved AXFR from
[203.166.224.7].21015 for "2nd.domain.com" (acl)


_______________________________________________________________
Have you tried Yahoo! Australia & NZ Shopping - http://au.shopping.yahoo.com