<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">Thanks</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">Sten</div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 14 Apr 2021, at 19.47, Carl Byington via bind-users <<a href="mailto:bind-users@lists.isc.org" class="">bind-users@lists.isc.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><div class="content-isolator__container"><div class="protected-part"><div class="protected-title">Signed PGP part</div><div class="protected-content">On Wed, 2021-04-14 at 12:58 -0400, Paul Kosinski via bind-users wrote:<br class="">> Interesting, although we host different domains, in and from different<br class="">> geographic areas, we got the same queries as yours on the same day,<br class="">> with some at about the same time (we're EDT).<br class="">> 13-Apr-2021 02:19:58.468 security: info: client 76.20.145.58#3074<br class="">> (sl): query (cache) 'sl/ANY/IN' denied<br class="">> 13-Apr-2021 02:19:58.638 security: info: client 76.20.145.58#3074<br class="">> (sl): query (cache) 'sl/ANY/IN' denied<br class=""><br class="">These times are PDT (-0700)<br class=""><br class="">Apr 12 23:18:13 ns named[5091]: client @0x7fda540105b8 76.20.145.58#3074<br class="">(sl): view normal: query (cache) 'sl/ANY/IN' denied<br class="">Apr 12 23:18:13 ns named[5091]: client @0x7fda540105b8 76.20.145.58#3074<br class="">(sl): view normal: query (cache) 'sl/ANY/IN' denied<br class="">....<br class="">Apr 12 23:19:15 ns named[5091]: client @0x7fda540105b8 76.20.145.58#3074<br class="">(sl): view normal: query (cache) 'sl/ANY/IN' denied<br class=""><br class="">So either 76.20.145.58, or someone forging that source ip, made queries<br class="">to servers in (+0000), (-0400), and (-0700) at the same time. Malware<br class="">running on 76.20.145.58 is one explanation. Would the REFUSED replies<br class="">carry enough information from the original query to be used as a covert<br class="">communication channel into something listening on 76.20.145.58?<br class=""><br class="">vpn over dns query-refused replies? That seems a bit far-fetched.<br class=""></div></div></div></div></div></blockquote><div><br class=""></div>I wonder if it may be an attempt to keep track of the Internet speed across the world?</div><div>If you send off these queries at the same time to different locations what would the round trip time tell you?</div><div>It would probably be a fair assessment of the speed of the net - might be a replacement for pings.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><div class="content-isolator__container"><div class="protected-part"><div class="protected-content"><br class=""><br class=""></div></div><br class=""><iframe class="content-isolator__isolated-content" sandbox="allow-scripts" scrolling="auto" width="200" height="10" style="border:none;display:block;overflow:auto;" data-src="data:text/html;charset=UTF-8;base64,PGlmcmFtZS1jb250ZW50IGRhdGEtaWZyYW1lLWhlaWdodD0idHJ1ZSI+PEJSPjxCUj48QlI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188QlI+UGxlYXNlIHZpc2l0IGh0dHBzOi8vbGlzdHMuaXNjLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2JpbmQtdXNlcnMgdG8gdW5zdWJzY3JpYmUgZnJvbSB0aGlzIGxpc3Q8QlI+PEJSPklTQyBmdW5kcyB0aGUgZGV2ZWxvcG1lbnQgb2YgdGhpcyBzb2Z0d2FyZSB3aXRoIHBhaWQgc3VwcG9ydCBzdWJzY3JpcHRpb25zLiBDb250YWN0IHVzIGF0IGh0dHBzOi8vd3d3LmlzYy5vcmcvY29udGFjdC8gZm9yIG1vcmUgaW5mb3JtYXRpb24uPEJSPjxCUj48QlI+YmluZC11c2VycyBtYWlsaW5nIGxpc3Q8QlI+YmluZC11c2Vyc0BsaXN0cy5pc2Mub3JnPEJSPmh0dHBzOi8vbGlzdHMuaXNjLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2JpbmQtdXNlcnM8QlI+PC9pZnJhbWUtY29udGVudD4="></iframe></div></div></div></blockquote></div><br class=""></body></html>