Is someone trying to hack my dns and illegally transfer me records?

Barry Margolin barmar at genuity.net
Wed Dec 19 21:42:34 UTC 2001


In article <9vqt37$osv at pub3.rc.vix.com>, Paul  <p2000j at yahoo.com> wrote:
> I have noticed that in my logs it shows the message;
>
>named[741]: client 128.177.195.11#60877: zone transfer denied
>
>Hundreds of times.  The address is not one of our secondaries and I do not 
>recognize the above address. Why do I have this message?  Could someone be 
>trying to do an unauthorized transfer of our domain's?  What do I do about 
>this?

That address resolves to test-01.gdib.nominum.com.  Nominum is the company
that develops BIND.  Why don't you ask them what they're doing?  From the
hostname, my guess is it's some kind of Internet-wide test or survey.

-- 
Barry Margolin, barmar at genuity.net
Genuity, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.


More information about the bind-users mailing list