Random nx name queries, anyone see this before?

Frank Behrens frank at harz.behrens.de
Tue Dec 16 06:58:43 UTC 2008


ponga2112 at gmail.com <ponga2112 at gmail.com> wrote on 15 Dec 2008 16:34:
> I'd be very interested in what others find. I do have an update and
> correction to my original post:
> 
> The format is 9chars.8chars - as an example:
> qjnqrtfun.wxsifmgj
> Sometimes a colon appears, so the char list seems to be [a-z:]
> Also, I was wrong about the FQDN - they do appear in named/bind logs -
> so whatever app it is, the suffix search order is being used. My
> apologies for the incorrect info the first time.
> 
> Thre are a couple clients that do this - so thanks for the tip AlanC,
> I will look for a pattern. Other than that, I'm stumped. Thanks for
> any hints provided!!

Is it possible that a bot net tries to connect?
http://www.heise-online.co.uk/security/Botnet-rises-again--/news/112118

I don't want to make a panic, it's an idea only...


-- 
Frank Behrens, Osterwieck, Germany
PGP-key 0x5B7C47ED on public servers available.




More information about the bind-users mailing list