Compromised BIND?

Stephane Bortzmeyer bortzmeyer at
Tue May 31 19:30:56 UTC 2011

On Tue, May 31, 2011 at 02:38:13PM -0400,
 Supersonic <wbpfsguy at> wrote 
 a message of 38 lines which said:

> My firewall is showing repeated attempts by named.exe to connect to
> IP addresses in foreign countries on ports 6666, 6667 and 6669

Not enough information to decide. For instance, what was the source
port of these packets? If it is 53, it may simply be BIND answering to
requests having the source port 6666.

More information about the bind-users mailing list