random dns queries with random sources

Wed Feb 19 04:07:24 UTC 2014

On Feb 19, 2014, at 10:48 AM, Christopher Morrow <morrowc.lists at gmail.com> wrote:

> apologies. both chl.net and chl.com ... which appear to be parts of ttec ... which is joe.

Premature send - I meant to add 'Or against the authoritative servers for 5kkx.com?'

We've been seeing a spate of reflected (not amplified) DNS attacks against various authoritative servers in Europe for the past week or so, bounced through some type of consumer DSL broadband CPE with an open DNS forwarded on the WAN interface (don't know the make/model, but it was supplied by the broadband operators to the customers), on some European broadband access networks.  

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton