DNS noise

Michael Sinatra michael at rancid.berkeley.edu
Fri Apr 6 12:51:50 CDT 2012


On 04/06/12 10:47, Keegan Holley wrote:
> Have you tried contacting the owner of the IP?  A DDOS attack from that
> particular IP would be ironic.
>
> #
> # The following results may also be obtained via:
> #
> http://whois.arin.net/rest/nets;q=72.20.23.24?showDetails=true&showARIN=false&ext=netref2
> #
>
> Staminus Communications STAMINUS-COMMUNICATIONS (NET-72-20-0-0-1) 72.20.0.0
> - 72.20.63.255
> DDOSWIZ.COM STAMINUS-COMMUNICATIONS (NET-72-20-23-0-1) 72.20.23.0 -
> 72.20.23.63

If it's an attempt at a reflective DNS-based DDoS attack, then the 
source IP address making the query is likely spoofed.  The IP address in 
question is really the target, not the source of the attack.

That is, of course, if this is a standard reflective DDoS attack.

michael



More information about the NANOG mailing list