Hatena::ブログ(Diary)

NO!と言えるようになりたい

2013-11-15

llvmのエラーメッセージがわかりやすかった

foo.m_bar と書くべきところを,foo.bar と書いていたら,foo.m_bar なんじゃないのと指摘してくれた.なんだこれは.たまげたなあ.凄い(確信).

こんなかんじで書いていると,

class ssl_info {
public:
    ptr_cdpi_ssl m_client;
};

void func() {
    get_ssl_obj(info.client, b1);
}

このようにエラーを出すのだ.

/home/ytakano/program/c/catenaccio_dpi/src/cdpi_mongo.cpp:394:22: error: no
      member named 'client' in 'my_event_listener::ssl_info'; did you mean
      'm_client'?
    get_ssl_obj(info.client, b1);
                     ^~~~~~
                     m_client
/home/ytakano/program/c/catenaccio_dpi/src/cdpi_mongo.hpp:69:22: note: 
      'm_client' declared here
        ptr_cdpi_ssl m_client;

しかし,emacsがllvmのエラーメッセージのパースに失敗してて,エラー行へのジャンプが上手く行かなくて困る.

2013-11-10

gccとllvmのコンパイル時間

計測したソースコードはこれ https://github.com/ytakano/catenaccio_dpi

まずは,最適化無し(-g -O0)から.

$ cmake -DCMAKE_CXX_COMPILER=clang++ .
$ cmake -DCMAKE_BUILD_TYPE=Debug -DUSE_MONGO=1 .
$ time make
make  43.50s user 3.08s system 99% cpu 46.746 total
$ cmake -DCMAKE_CXX_COMPILER=g++ .
$ cmake -DCMAKE_BUILD_TYPE=Debug -DUSE_MONGO=1 .
$ time make
make  61.12s user 4.26s system 99% cpu 1:05.61 total

18秒ぐらいllvmの方が速い.

続いて最適化あり(-O3)の場合.

$ cmake -DCMAKE_CXX_COMPILER=clang++ .
$ cmake -DCMAKE_BUILD_TYPE=Debug -DUSE_MONGO=1 .
$ time make
make  53.71s user 2.77s system 99% cpu 56.534 total
$ cmake -DCMAKE_CXX_COMPILER=g++ .
$ cmake -DCMAKE_BUILD_TYPE=Debug -DUSE_MONGO=1 .
$ time make
make  87.73s user 4.15s system 99% cpu 1:31.94 total

34秒ぐらいllvmの方が速い.

2013-10-23

Observation of DNS Amplification Attack (krasti.us)

$ dig @::1 krasti.us any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 krasti.us any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44376
;; flags: qr rd ra; QUERY: 1, ANSWER: 35, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;krasti.us.			IN	ANY

;; ANSWER SECTION:
krasti.us.		600	IN	A	184.168.221.51
krasti.us.		604800	IN	MX	10 lolwutevet1.ddos-guard.sux.net.antipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksuckssucksuck.com.
krasti.us.		604800	IN	MX	21 lolwutevet2.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksuscksuck.com.
krasti.us.		604800	IN	MX	22 lolwutevet3.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksuckncsucksuck.com.
krasti.us.		604800	IN	MX	23 lolwutevet4.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucnksucksuck.com.
krasti.us.		604800	IN	MX	24 lolwutevet5.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksu0cksucksuck.com.
krasti.us.		604800	IN	MX	26 lolwutevet8.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresuck8sucksucksuck.com.
krasti.us.		604800	IN	MX	28 lolwutevet0.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresuc7ksucksucksuck.com.
krasti.us.		604800	IN	MX	29 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouares6ucksucksucksuck.com.
krasti.us.		604800	IN	MX	30 lolwutevet23.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouare5sucksucksucksuck.com.
krasti.us.		604800	IN	MX	32 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouar4esucksucksucksuck.com.
krasti.us.		604800	IN	MX	10 lolwutevet1.ddos-guard.sux.net.antipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyou3aresucksucksucksuck.com.
krasti.us.		604800	IN	MX	21 lolwutevet2.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyoua2resucksucksucksuck.com.
krasti.us.		604800	IN	MX	22 lolwutevet3.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyou1aresucksucksucksuxck.com.
krasti.us.		604800	IN	MX	23 lolwutevet4.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucknbsuxck.com.
krasti.us.		604800	IN	MX	24 lolwutevet5.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuck.com.
krasti.us.		604800	IN	MX	26 lolwutevet8.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksugck.com.
krasti.us.		604800	IN	MX	28 lolwutevet0.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksuckgsuck.com.
krasti.us.		604800	IN	MX	29 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksgucksuck.com.
krasti.us.		604800	IN	MX	30 lolwutevet23.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucgknsuck.com.
krasti.us.		604800	IN	MX	32 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckn.com.
krasti.us.		604800	IN	MX	10 lolwutevet1.ddos-guard.sux.net.antipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksucdk.com.
krasti.us.		604800	IN	MX	21 lolwutevet2.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckd.com.
krasti.us.		604800	IN	MX	22 lolwutevet3.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksugckd.com.
krasti.us.		604800	IN	MX	23 lolwutevet4.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckn.com.
krasti.us.		604800	IN	MX	24 lolwutevet5.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckg.com.
krasti.us.		604800	IN	MX	26 lolwutevet8.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckg.com.
krasti.us.		604800	IN	MX	28 lolwutevet0.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckg.com.
krasti.us.		604800	IN	MX	30 lolwutevet23.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuckf.com.
krasti.us.		604800	IN	MX	32 lolwutevet33.ddos-guard.sux.net.aipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksucku.com.
krasti.us.		604800	IN	MX	10 lolwutevet1.ddos-guard.sux.net.antipainkillyouallmydomainthebestever.h4xored.by.antipainlolwutandyouaresucksucksucksuck.com.
krasti.us.		3600	IN	NS	ns09.domaincontrol.com.
krasti.us.		3600	IN	NS	ns10.domaincontrol.com.
krasti.us.		604800	IN	TXT	"sdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdasssdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdas5533 > sdasd" "assdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdasdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdas5533 > sdasdassdasd" "assdasdassdasdassdasdassdasdassdasdassdasdassdaasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdas5533 > sdasdassdasdassda" "sdassdasdassdasdassdasdassdasdassdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdasdassdas5533 > sdasdassdasdassdasdassdasdassdasdassd" "asda"
krasti.us.		3600	IN	SOA	ns09.domaincontrol.com. dns.jomax.net. 2013102200 28800 7200 604800 600

;; Query time: 8 msec
;; SERVER: ::1#53(::1)
;; WHEN: Wed Oct 23 18:04:24 JST 2013
;; MSG SIZE  rcvd: 4886
$ dig @::1 krasti.us ns

; <<>> DiG 9.8.5-P1 <<>> @::1 krasti.us ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62904
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;krasti.us.			IN	NS

;; ANSWER SECTION:
krasti.us.		3526	IN	NS	ns09.domaincontrol.com.
krasti.us.		3526	IN	NS	ns10.domaincontrol.com.

;; Query time: 171 msec
;; SERVER: ::1#53(::1)
;; WHEN: Wed Oct 23 18:05:38 JST 2013
;; MSG SIZE  rcvd: 82
ns09.domaincontrol.com.	71506	IN	A	216.69.185.5
ns10.domaincontrol.com.	71502	IN	A	208.109.255.5
$ whois 216.69.185.5

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 216.69.185.5"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=216.69.185.5?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       216.69.128.0 - 216.69.191.255
CIDR:           216.69.128.0/18
OriginAS:
NetName:        GO-DADDY-COM-LLC
NetHandle:      NET-216-69-128-0-1
Parent:         NET-216-0-0-0-0
NetType:        Direct Allocation
RegDate:        2004-05-24
Updated:        2012-02-24
Ref:            http://whois.arin.net/rest/net/NET-216-69-128-0-1

OrgName:        GoDaddy.com, LLC
OrgId:          GODAD
Address:        14455 N Hayden Road
Address:        Suite 226
City:           Scottsdale
StateProv:      AZ
PostalCode:     85260
Country:        US
RegDate:        2007-06-01
Updated:        2012-03-15
Comment:        Please send abuse complaints to abuse@godaddy.com
Ref:            http://whois.arin.net/rest/org/GODAD

OrgAbuseHandle: ABUSE51-ARIN
OrgAbuseName:   Abuse Department
OrgAbusePhone:  +1-480-624-2505
OrgAbuseEmail:  abuse@godaddy.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE51-ARIN

OrgNOCHandle: NOC124-ARIN
OrgNOCName:   Network Operations Center
OrgNOCPhone:  +1-480-505-8809
OrgNOCEmail:  noc@godaddy.com
OrgNOCRef:    http://whois.arin.net/rest/poc/NOC124-ARIN

OrgTechHandle: NOC124-ARIN
OrgTechName:   Network Operations Center
OrgTechPhone:  +1-480-505-8809
OrgTechEmail:  noc@godaddy.com
OrgTechRef:    http://whois.arin.net/rest/poc/NOC124-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html

2013-10-22

Observation of DNS Amplification Attack (txt.fwserver.com.ua)

$ dig @::1 txt.fwserver.com.ua any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 txt.fwserver.com.ua any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35790
;; flags: qr rd ra; QUERY: 1, ANSWER: 244, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;txt.fwserver.com.ua.		IN	ANY

;; ANSWER SECTION:
txt.fwserver.com.ua.	28800	IN	SOA	ns1.ua-dc.net. root.ua-dc.net. 2013090211 28800 7200 1209600 2600
txt.fwserver.com.ua.	28800	IN	NS	ns1.ua-dc.net.
txt.fwserver.com.ua.	28800	IN	NS	ns2.ua-dc.net.
txt.fwserver.com.ua.	28800	IN	A	204.46.43.140
txt.fwserver.com.ua.	28800	IN	A	204.46.43.141
txt.fwserver.com.ua.	28800	IN	A	204.46.43.142
txt.fwserver.com.ua.	28800	IN	A	204.46.43.143
txt.fwserver.com.ua.	28800	IN	A	204.46.43.144
txt.fwserver.com.ua.	28800	IN	A	204.46.43.145
txt.fwserver.com.ua.	28800	IN	A	204.46.43.146
txt.fwserver.com.ua.	28800	IN	A	204.46.43.147
txt.fwserver.com.ua.	28800	IN	A	204.46.43.148
txt.fwserver.com.ua.	28800	IN	A	204.46.43.149
txt.fwserver.com.ua.	28800	IN	A	204.46.43.150
txt.fwserver.com.ua.	28800	IN	A	204.46.43.151
txt.fwserver.com.ua.	28800	IN	A	204.46.43.152
txt.fwserver.com.ua.	28800	IN	A	204.46.43.153
txt.fwserver.com.ua.	28800	IN	A	204.46.43.154
txt.fwserver.com.ua.	28800	IN	A	204.46.43.155
txt.fwserver.com.ua.	28800	IN	A	204.46.43.156
txt.fwserver.com.ua.	28800	IN	A	204.46.43.157
txt.fwserver.com.ua.	28800	IN	A	204.46.43.158
txt.fwserver.com.ua.	28800	IN	A	204.46.43.159
txt.fwserver.com.ua.	28800	IN	A	204.46.43.160
txt.fwserver.com.ua.	28800	IN	A	204.46.43.161
txt.fwserver.com.ua.	28800	IN	A	204.46.43.162
txt.fwserver.com.ua.	28800	IN	A	204.46.43.163
txt.fwserver.com.ua.	28800	IN	A	204.46.43.164
txt.fwserver.com.ua.	28800	IN	A	204.46.43.165
txt.fwserver.com.ua.	28800	IN	A	204.46.43.166
txt.fwserver.com.ua.	28800	IN	A	204.46.43.167
txt.fwserver.com.ua.	28800	IN	A	204.46.43.168
txt.fwserver.com.ua.	28800	IN	A	204.46.43.169
txt.fwserver.com.ua.	28800	IN	A	204.46.43.170
txt.fwserver.com.ua.	28800	IN	A	204.46.43.171
txt.fwserver.com.ua.	28800	IN	A	204.46.43.172
txt.fwserver.com.ua.	28800	IN	A	204.46.43.173
txt.fwserver.com.ua.	28800	IN	A	204.46.43.174
txt.fwserver.com.ua.	28800	IN	A	204.46.43.175
txt.fwserver.com.ua.	28800	IN	A	204.46.43.176
txt.fwserver.com.ua.	28800	IN	A	204.46.43.177
txt.fwserver.com.ua.	28800	IN	A	204.46.43.178
txt.fwserver.com.ua.	28800	IN	A	204.46.43.179
txt.fwserver.com.ua.	28800	IN	A	204.46.43.180
txt.fwserver.com.ua.	28800	IN	A	204.46.43.181
txt.fwserver.com.ua.	28800	IN	A	204.46.43.182
txt.fwserver.com.ua.	28800	IN	A	204.46.43.183
txt.fwserver.com.ua.	28800	IN	A	204.46.43.184
txt.fwserver.com.ua.	28800	IN	A	204.46.43.185
txt.fwserver.com.ua.	28800	IN	A	204.46.43.186
txt.fwserver.com.ua.	28800	IN	A	204.46.43.187
txt.fwserver.com.ua.	28800	IN	A	204.46.43.188
txt.fwserver.com.ua.	28800	IN	A	204.46.43.189
txt.fwserver.com.ua.	28800	IN	A	204.46.43.190
txt.fwserver.com.ua.	28800	IN	A	204.46.43.191
txt.fwserver.com.ua.	28800	IN	A	204.46.43.192
txt.fwserver.com.ua.	28800	IN	A	204.46.43.193
txt.fwserver.com.ua.	28800	IN	A	204.46.43.194
txt.fwserver.com.ua.	28800	IN	A	204.46.43.195
txt.fwserver.com.ua.	28800	IN	A	204.46.43.196
txt.fwserver.com.ua.	28800	IN	A	204.46.43.197
txt.fwserver.com.ua.	28800	IN	A	204.46.43.198
txt.fwserver.com.ua.	28800	IN	A	204.46.43.199
txt.fwserver.com.ua.	28800	IN	A	204.46.43.200
txt.fwserver.com.ua.	28800	IN	A	204.46.43.201
txt.fwserver.com.ua.	28800	IN	A	204.46.43.202
txt.fwserver.com.ua.	28800	IN	A	204.46.43.203
txt.fwserver.com.ua.	28800	IN	A	204.46.43.204
txt.fwserver.com.ua.	28800	IN	A	204.46.43.205
txt.fwserver.com.ua.	28800	IN	A	204.46.43.206
txt.fwserver.com.ua.	28800	IN	A	204.46.43.207
txt.fwserver.com.ua.	28800	IN	A	204.46.43.208
txt.fwserver.com.ua.	28800	IN	A	204.46.43.209
txt.fwserver.com.ua.	28800	IN	A	204.46.43.210
txt.fwserver.com.ua.	28800	IN	A	204.46.43.211
txt.fwserver.com.ua.	28800	IN	A	204.46.43.212
txt.fwserver.com.ua.	28800	IN	A	204.46.43.213
txt.fwserver.com.ua.	28800	IN	A	204.46.43.214
txt.fwserver.com.ua.	28800	IN	A	204.46.43.215
txt.fwserver.com.ua.	28800	IN	A	204.46.43.216
txt.fwserver.com.ua.	28800	IN	A	204.46.43.217
txt.fwserver.com.ua.	28800	IN	A	204.46.43.218
txt.fwserver.com.ua.	28800	IN	A	204.46.43.219
txt.fwserver.com.ua.	28800	IN	A	204.46.43.220
txt.fwserver.com.ua.	28800	IN	A	204.46.43.221
txt.fwserver.com.ua.	28800	IN	A	204.46.43.222
txt.fwserver.com.ua.	28800	IN	A	204.46.43.223
txt.fwserver.com.ua.	28800	IN	A	204.46.43.224
txt.fwserver.com.ua.	28800	IN	A	204.46.43.225
txt.fwserver.com.ua.	28800	IN	A	204.46.43.226
txt.fwserver.com.ua.	28800	IN	A	204.46.43.227
txt.fwserver.com.ua.	28800	IN	A	204.46.43.228
txt.fwserver.com.ua.	28800	IN	A	204.46.43.229
txt.fwserver.com.ua.	28800	IN	A	204.46.43.230
txt.fwserver.com.ua.	28800	IN	A	204.46.43.231
txt.fwserver.com.ua.	28800	IN	A	204.46.43.232
txt.fwserver.com.ua.	28800	IN	A	204.46.43.233
txt.fwserver.com.ua.	28800	IN	A	204.46.43.234
txt.fwserver.com.ua.	28800	IN	A	204.46.43.235
txt.fwserver.com.ua.	28800	IN	A	204.46.43.236
txt.fwserver.com.ua.	28800	IN	A	204.46.43.237
txt.fwserver.com.ua.	28800	IN	A	204.46.43.238
txt.fwserver.com.ua.	28800	IN	A	204.46.43.239
txt.fwserver.com.ua.	28800	IN	A	204.46.43.240
txt.fwserver.com.ua.	28800	IN	A	91.212.124.2
txt.fwserver.com.ua.	28800	IN	A	204.46.43.1
txt.fwserver.com.ua.	28800	IN	A	204.46.43.2
txt.fwserver.com.ua.	28800	IN	A	204.46.43.3
txt.fwserver.com.ua.	28800	IN	A	204.46.43.4
txt.fwserver.com.ua.	28800	IN	A	204.46.43.5
txt.fwserver.com.ua.	28800	IN	A	204.46.43.6
txt.fwserver.com.ua.	28800	IN	A	204.46.43.7
txt.fwserver.com.ua.	28800	IN	A	204.46.43.8
txt.fwserver.com.ua.	28800	IN	A	204.46.43.9
txt.fwserver.com.ua.	28800	IN	A	204.46.43.10
txt.fwserver.com.ua.	28800	IN	A	204.46.43.11
txt.fwserver.com.ua.	28800	IN	A	204.46.43.12
txt.fwserver.com.ua.	28800	IN	A	204.46.43.13
txt.fwserver.com.ua.	28800	IN	A	204.46.43.14
txt.fwserver.com.ua.	28800	IN	A	204.46.43.15
txt.fwserver.com.ua.	28800	IN	A	204.46.43.16
txt.fwserver.com.ua.	28800	IN	A	204.46.43.17
txt.fwserver.com.ua.	28800	IN	A	204.46.43.18
txt.fwserver.com.ua.	28800	IN	A	204.46.43.19
txt.fwserver.com.ua.	28800	IN	A	204.46.43.20
txt.fwserver.com.ua.	28800	IN	A	204.46.43.21
txt.fwserver.com.ua.	28800	IN	A	204.46.43.22
txt.fwserver.com.ua.	28800	IN	A	204.46.43.23
txt.fwserver.com.ua.	28800	IN	A	204.46.43.24
txt.fwserver.com.ua.	28800	IN	A	204.46.43.25
txt.fwserver.com.ua.	28800	IN	A	204.46.43.26
txt.fwserver.com.ua.	28800	IN	A	204.46.43.27
txt.fwserver.com.ua.	28800	IN	A	204.46.43.28
txt.fwserver.com.ua.	28800	IN	A	204.46.43.29
txt.fwserver.com.ua.	28800	IN	A	204.46.43.30
txt.fwserver.com.ua.	28800	IN	A	204.46.43.31
txt.fwserver.com.ua.	28800	IN	A	204.46.43.32
txt.fwserver.com.ua.	28800	IN	A	204.46.43.33
txt.fwserver.com.ua.	28800	IN	A	204.46.43.34
txt.fwserver.com.ua.	28800	IN	A	204.46.43.35
txt.fwserver.com.ua.	28800	IN	A	204.46.43.36
txt.fwserver.com.ua.	28800	IN	A	204.46.43.37
txt.fwserver.com.ua.	28800	IN	A	204.46.43.38
txt.fwserver.com.ua.	28800	IN	A	204.46.43.39
txt.fwserver.com.ua.	28800	IN	A	204.46.43.40
txt.fwserver.com.ua.	28800	IN	A	204.46.43.41
txt.fwserver.com.ua.	28800	IN	A	204.46.43.42
txt.fwserver.com.ua.	28800	IN	A	204.46.43.43
txt.fwserver.com.ua.	28800	IN	A	204.46.43.44
txt.fwserver.com.ua.	28800	IN	A	204.46.43.45
txt.fwserver.com.ua.	28800	IN	A	204.46.43.46
txt.fwserver.com.ua.	28800	IN	A	204.46.43.47
txt.fwserver.com.ua.	28800	IN	A	204.46.43.48
txt.fwserver.com.ua.	28800	IN	A	204.46.43.49
txt.fwserver.com.ua.	28800	IN	A	204.46.43.50
txt.fwserver.com.ua.	28800	IN	A	204.46.43.51
txt.fwserver.com.ua.	28800	IN	A	204.46.43.52
txt.fwserver.com.ua.	28800	IN	A	204.46.43.53
txt.fwserver.com.ua.	28800	IN	A	204.46.43.54
txt.fwserver.com.ua.	28800	IN	A	204.46.43.55
txt.fwserver.com.ua.	28800	IN	A	204.46.43.56
txt.fwserver.com.ua.	28800	IN	A	204.46.43.57
txt.fwserver.com.ua.	28800	IN	A	204.46.43.58
txt.fwserver.com.ua.	28800	IN	A	204.46.43.59
txt.fwserver.com.ua.	28800	IN	A	204.46.43.60
txt.fwserver.com.ua.	28800	IN	A	204.46.43.61
txt.fwserver.com.ua.	28800	IN	A	204.46.43.62
txt.fwserver.com.ua.	28800	IN	A	204.46.43.63
txt.fwserver.com.ua.	28800	IN	A	204.46.43.64
txt.fwserver.com.ua.	28800	IN	A	204.46.43.65
txt.fwserver.com.ua.	28800	IN	A	204.46.43.66
txt.fwserver.com.ua.	28800	IN	A	204.46.43.67
txt.fwserver.com.ua.	28800	IN	A	204.46.43.68
txt.fwserver.com.ua.	28800	IN	A	204.46.43.69
txt.fwserver.com.ua.	28800	IN	A	204.46.43.70
txt.fwserver.com.ua.	28800	IN	A	204.46.43.71
txt.fwserver.com.ua.	28800	IN	A	204.46.43.72
txt.fwserver.com.ua.	28800	IN	A	204.46.43.73
txt.fwserver.com.ua.	28800	IN	A	204.46.43.74
txt.fwserver.com.ua.	28800	IN	A	204.46.43.75
txt.fwserver.com.ua.	28800	IN	A	204.46.43.76
txt.fwserver.com.ua.	28800	IN	A	204.46.43.77
txt.fwserver.com.ua.	28800	IN	A	204.46.43.78
txt.fwserver.com.ua.	28800	IN	A	204.46.43.79
txt.fwserver.com.ua.	28800	IN	A	204.46.43.80
txt.fwserver.com.ua.	28800	IN	A	204.46.43.81
txt.fwserver.com.ua.	28800	IN	A	204.46.43.82
txt.fwserver.com.ua.	28800	IN	A	204.46.43.83
txt.fwserver.com.ua.	28800	IN	A	204.46.43.84
txt.fwserver.com.ua.	28800	IN	A	204.46.43.85
txt.fwserver.com.ua.	28800	IN	A	204.46.43.86
txt.fwserver.com.ua.	28800	IN	A	204.46.43.87
txt.fwserver.com.ua.	28800	IN	A	204.46.43.88
txt.fwserver.com.ua.	28800	IN	A	204.46.43.89
txt.fwserver.com.ua.	28800	IN	A	204.46.43.90
txt.fwserver.com.ua.	28800	IN	A	204.46.43.91
txt.fwserver.com.ua.	28800	IN	A	204.46.43.92
txt.fwserver.com.ua.	28800	IN	A	204.46.43.93
txt.fwserver.com.ua.	28800	IN	A	204.46.43.94
txt.fwserver.com.ua.	28800	IN	A	204.46.43.95
txt.fwserver.com.ua.	28800	IN	A	204.46.43.96
txt.fwserver.com.ua.	28800	IN	A	204.46.43.97
txt.fwserver.com.ua.	28800	IN	A	204.46.43.98
txt.fwserver.com.ua.	28800	IN	A	204.46.43.99
txt.fwserver.com.ua.	28800	IN	A	204.46.43.100
txt.fwserver.com.ua.	28800	IN	A	204.46.43.101
txt.fwserver.com.ua.	28800	IN	A	204.46.43.102
txt.fwserver.com.ua.	28800	IN	A	204.46.43.103
txt.fwserver.com.ua.	28800	IN	A	204.46.43.104
txt.fwserver.com.ua.	28800	IN	A	204.46.43.105
txt.fwserver.com.ua.	28800	IN	A	204.46.43.106
txt.fwserver.com.ua.	28800	IN	A	204.46.43.107
txt.fwserver.com.ua.	28800	IN	A	204.46.43.108
txt.fwserver.com.ua.	28800	IN	A	204.46.43.109
txt.fwserver.com.ua.	28800	IN	A	204.46.43.110
txt.fwserver.com.ua.	28800	IN	A	204.46.43.111
txt.fwserver.com.ua.	28800	IN	A	204.46.43.112
txt.fwserver.com.ua.	28800	IN	A	204.46.43.113
txt.fwserver.com.ua.	28800	IN	A	204.46.43.114
txt.fwserver.com.ua.	28800	IN	A	204.46.43.115
txt.fwserver.com.ua.	28800	IN	A	204.46.43.116
txt.fwserver.com.ua.	28800	IN	A	204.46.43.117
txt.fwserver.com.ua.	28800	IN	A	204.46.43.118
txt.fwserver.com.ua.	28800	IN	A	204.46.43.119
txt.fwserver.com.ua.	28800	IN	A	204.46.43.120
txt.fwserver.com.ua.	28800	IN	A	204.46.43.121
txt.fwserver.com.ua.	28800	IN	A	204.46.43.122
txt.fwserver.com.ua.	28800	IN	A	204.46.43.123
txt.fwserver.com.ua.	28800	IN	A	204.46.43.124
txt.fwserver.com.ua.	28800	IN	A	204.46.43.125
txt.fwserver.com.ua.	28800	IN	A	204.46.43.126
txt.fwserver.com.ua.	28800	IN	A	204.46.43.127
txt.fwserver.com.ua.	28800	IN	A	204.46.43.128
txt.fwserver.com.ua.	28800	IN	A	204.46.43.129
txt.fwserver.com.ua.	28800	IN	A	204.46.43.130
txt.fwserver.com.ua.	28800	IN	A	204.46.43.131
txt.fwserver.com.ua.	28800	IN	A	204.46.43.132
txt.fwserver.com.ua.	28800	IN	A	204.46.43.133
txt.fwserver.com.ua.	28800	IN	A	204.46.43.134
txt.fwserver.com.ua.	28800	IN	A	204.46.43.135
txt.fwserver.com.ua.	28800	IN	A	204.46.43.136
txt.fwserver.com.ua.	28800	IN	A	204.46.43.137
txt.fwserver.com.ua.	28800	IN	A	204.46.43.138
txt.fwserver.com.ua.	28800	IN	A	204.46.43.139

;; Query time: 10 msec
;; SERVER: ::1#53(::1)
;; WHEN: Tue Oct 22 18:56:46 JST 2013
;; MSG SIZE  rcvd: 3979
$ whois 91.212.124.5

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 91.212.124.5"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=91.212.124.5?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       91.0.0.0 - 91.255.255.255
CIDR:           91.0.0.0/8
OriginAS:
NetName:        91-RIPE
NetHandle:      NET-91-0-0-0-1
Parent:
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
RegDate:        2005-06-30
Updated:        2009-05-18
Ref:            http://whois.arin.net/rest/net/NET-91-0-0-0-1

OrgName:        RIPE Network Coordination Centre
OrgId:          RIPE
Address:        P.O. Box 10096
City:           Amsterdam
StateProv:
PostalCode:     1001EB
Country:        NL
RegDate:
Updated:        2013-07-29
Ref:            http://whois.arin.net/rest/org/RIPE

ReferralServer: whois://whois.ripe.net:43

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName:   Abuse Contact
OrgAbusePhone:  +31205354444
OrgAbuseEmail:  abuse@ripe.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName:   RIPE NCC Operations
OrgTechPhone:  +31 20 535 4444
OrgTechEmail:  hostmaster@ripe.net
OrgTechRef:    http://whois.arin.net/rest/poc/RNO29-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '91.212.124.0 - 91.212.124.255'

inetnum:        91.212.124.0 - 91.212.124.255
netname:        AN-NET
descr:          Nikultsev Aleksandr Nikolaevich
country:        UA
org:            ORG-AN36-RIPE
admin-c:        ANN80-RIPE
tech-c:         ANN80-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-lower:      RIPE-NCC-END-MNT
mnt-by:         MNT-AN
mnt-routes:     MNT-AN
mnt-domains:    MNT-AN
source:         RIPE # Filtered

organisation:   ORG-AN36-RIPE
org-name:       Nikultsev Aleksandr Nikolaevich
org-type:       OTHER
address:        11/22, Sherbiny str.
address:        Dnepropetrovsk, Ukraine
phone:          +380 95 5852446
mnt-ref:        MNT-AN
mnt-by:         MNT-AN
source:         RIPE # Filtered

person:         Alexander Nikultsev
address:        49130, Ukraine, Dniepropetrovsk, Sherbiny str 11/22
phone:          +380 95 5852446
nic-hdl:        ANN80-RIPE
source:         RIPE # Filtered
mnt-by:         MNT-AN

% Information related to '91.212.124.0/24AS49089'

route:          91.212.124.0/24
descr:          UA-DC
mnt-routes:     MNT-AN
origin:         AS49089
mnt-by:         MNT-AN
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.69 (WHOIS4)

2013-10-19

Observation of DNS Amplification Attack (pipcvsemnaher.com)

NSs of pipcvsemnaher.com are same as NSs of zaikapaika.com and babywow.co.uk I observed before.

http://d.hatena.ne.jp/ytakano/20131011/1381507516

$ dig @::1 pipcvsemnaher.com any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 pipcvsemnaher.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52244
;; flags: qr rd ra; QUERY: 1, ANSWER: 245, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;pipcvsemnaher.com.		IN	ANY

;; ANSWER SECTION:
pipcvsemnaher.com.	10646	IN	NS	b.dns.gandi.net.
pipcvsemnaher.com.	10646	IN	NS	a.dns.gandi.net.
pipcvsemnaher.com.	10646	IN	NS	c.dns.gandi.net.
pipcvsemnaher.com.	10646	IN	A	204.46.43.64
pipcvsemnaher.com.	10646	IN	A	204.46.43.65
pipcvsemnaher.com.	10646	IN	A	204.46.43.66
pipcvsemnaher.com.	10646	IN	A	204.46.43.67
pipcvsemnaher.com.	10646	IN	A	204.46.43.68
pipcvsemnaher.com.	10646	IN	A	204.46.43.69
pipcvsemnaher.com.	10646	IN	A	204.46.43.70
pipcvsemnaher.com.	10646	IN	A	204.46.43.71
pipcvsemnaher.com.	10646	IN	A	204.46.43.72
pipcvsemnaher.com.	10646	IN	A	204.46.43.73
pipcvsemnaher.com.	10646	IN	A	204.46.43.74
pipcvsemnaher.com.	10646	IN	A	204.46.43.75
pipcvsemnaher.com.	10646	IN	A	204.46.43.76
pipcvsemnaher.com.	10646	IN	A	204.46.43.77
pipcvsemnaher.com.	10646	IN	A	204.46.43.78
pipcvsemnaher.com.	10646	IN	A	204.46.43.79
pipcvsemnaher.com.	10646	IN	A	204.46.43.80
pipcvsemnaher.com.	10646	IN	A	204.46.43.81
pipcvsemnaher.com.	10646	IN	A	204.46.43.82
pipcvsemnaher.com.	10646	IN	A	204.46.43.83
pipcvsemnaher.com.	10646	IN	A	204.46.43.84
pipcvsemnaher.com.	10646	IN	A	204.46.43.85
pipcvsemnaher.com.	10646	IN	A	204.46.43.86
pipcvsemnaher.com.	10646	IN	A	204.46.43.87
pipcvsemnaher.com.	10646	IN	A	204.46.43.88
pipcvsemnaher.com.	10646	IN	A	204.46.43.89
pipcvsemnaher.com.	10646	IN	A	204.46.43.90
pipcvsemnaher.com.	10646	IN	A	204.46.43.91
pipcvsemnaher.com.	10646	IN	A	204.46.43.92
pipcvsemnaher.com.	10646	IN	A	204.46.43.93
pipcvsemnaher.com.	10646	IN	A	204.46.43.94
pipcvsemnaher.com.	10646	IN	A	204.46.43.95
pipcvsemnaher.com.	10646	IN	A	204.46.43.96
pipcvsemnaher.com.	10646	IN	A	204.46.43.97
pipcvsemnaher.com.	10646	IN	A	204.46.43.98
pipcvsemnaher.com.	10646	IN	A	204.46.43.99
pipcvsemnaher.com.	10646	IN	A	204.46.43.100
pipcvsemnaher.com.	10646	IN	A	204.46.43.101
pipcvsemnaher.com.	10646	IN	A	204.46.43.102
pipcvsemnaher.com.	10646	IN	A	204.46.43.103
pipcvsemnaher.com.	10646	IN	A	204.46.43.104
pipcvsemnaher.com.	10646	IN	A	204.46.43.105
pipcvsemnaher.com.	10646	IN	A	204.46.43.106
pipcvsemnaher.com.	10646	IN	A	204.46.43.107
pipcvsemnaher.com.	10646	IN	A	204.46.43.108
pipcvsemnaher.com.	10646	IN	A	204.46.43.109
pipcvsemnaher.com.	10646	IN	A	204.46.43.110
pipcvsemnaher.com.	10646	IN	A	204.46.43.111
pipcvsemnaher.com.	10646	IN	A	204.46.43.112
pipcvsemnaher.com.	10646	IN	A	204.46.43.113
pipcvsemnaher.com.	10646	IN	A	204.46.43.114
pipcvsemnaher.com.	10646	IN	A	204.46.43.115
pipcvsemnaher.com.	10646	IN	A	204.46.43.116
pipcvsemnaher.com.	10646	IN	A	204.46.43.117
pipcvsemnaher.com.	10646	IN	A	204.46.43.118
pipcvsemnaher.com.	10646	IN	A	204.46.43.119
pipcvsemnaher.com.	10646	IN	A	204.46.43.120
pipcvsemnaher.com.	10646	IN	A	204.46.43.121
pipcvsemnaher.com.	10646	IN	A	204.46.43.122
pipcvsemnaher.com.	10646	IN	A	204.46.43.123
pipcvsemnaher.com.	10646	IN	A	204.46.43.124
pipcvsemnaher.com.	10646	IN	A	204.46.43.125
pipcvsemnaher.com.	10646	IN	A	204.46.43.126
pipcvsemnaher.com.	10646	IN	A	204.46.43.127
pipcvsemnaher.com.	10646	IN	A	204.46.43.128
pipcvsemnaher.com.	10646	IN	A	204.46.43.129
pipcvsemnaher.com.	10646	IN	A	204.46.43.130
pipcvsemnaher.com.	10646	IN	A	204.46.43.131
pipcvsemnaher.com.	10646	IN	A	204.46.43.132
pipcvsemnaher.com.	10646	IN	A	204.46.43.133
pipcvsemnaher.com.	10646	IN	A	204.46.43.134
pipcvsemnaher.com.	10646	IN	A	204.46.43.135
pipcvsemnaher.com.	10646	IN	A	204.46.43.137
pipcvsemnaher.com.	10646	IN	A	204.46.43.138
pipcvsemnaher.com.	10646	IN	A	204.46.43.139
pipcvsemnaher.com.	10646	IN	A	204.46.43.140
pipcvsemnaher.com.	10646	IN	A	204.46.43.141
pipcvsemnaher.com.	10646	IN	A	204.46.43.142
pipcvsemnaher.com.	10646	IN	A	204.46.43.143
pipcvsemnaher.com.	10646	IN	A	204.46.43.144
pipcvsemnaher.com.	10646	IN	A	204.46.43.145
pipcvsemnaher.com.	10646	IN	A	204.46.43.146
pipcvsemnaher.com.	10646	IN	A	204.46.43.147
pipcvsemnaher.com.	10646	IN	A	204.46.43.148
pipcvsemnaher.com.	10646	IN	A	204.46.43.149
pipcvsemnaher.com.	10646	IN	A	204.46.43.150
pipcvsemnaher.com.	10646	IN	A	204.46.43.151
pipcvsemnaher.com.	10646	IN	A	204.46.43.152
pipcvsemnaher.com.	10646	IN	A	204.46.43.153
pipcvsemnaher.com.	10646	IN	A	204.46.43.154
pipcvsemnaher.com.	10646	IN	A	204.46.43.155
pipcvsemnaher.com.	10646	IN	A	204.46.43.156
pipcvsemnaher.com.	10646	IN	A	204.46.43.157
pipcvsemnaher.com.	10646	IN	A	204.46.43.158
pipcvsemnaher.com.	10646	IN	A	204.46.43.159
pipcvsemnaher.com.	10646	IN	A	204.46.43.160
pipcvsemnaher.com.	10646	IN	A	204.46.43.161
pipcvsemnaher.com.	10646	IN	A	204.46.43.162
pipcvsemnaher.com.	10646	IN	A	204.46.43.163
pipcvsemnaher.com.	10646	IN	A	204.46.43.164
pipcvsemnaher.com.	10646	IN	A	204.46.43.165
pipcvsemnaher.com.	10646	IN	A	204.46.43.166
pipcvsemnaher.com.	10646	IN	A	204.46.43.167
pipcvsemnaher.com.	10646	IN	A	204.46.43.168
pipcvsemnaher.com.	10646	IN	A	204.46.43.169
pipcvsemnaher.com.	10646	IN	A	204.46.43.170
pipcvsemnaher.com.	10646	IN	A	204.46.43.171
pipcvsemnaher.com.	10646	IN	A	204.46.43.172
pipcvsemnaher.com.	10646	IN	A	204.46.43.173
pipcvsemnaher.com.	10646	IN	A	204.46.43.174
pipcvsemnaher.com.	10646	IN	A	204.46.43.175
pipcvsemnaher.com.	10646	IN	A	204.46.43.176
pipcvsemnaher.com.	10646	IN	A	204.46.43.177
pipcvsemnaher.com.	10646	IN	A	204.46.43.178
pipcvsemnaher.com.	10646	IN	A	204.46.43.179
pipcvsemnaher.com.	10646	IN	A	204.46.43.180
pipcvsemnaher.com.	10646	IN	A	204.46.43.181
pipcvsemnaher.com.	10646	IN	A	204.46.43.182
pipcvsemnaher.com.	10646	IN	A	204.46.43.183
pipcvsemnaher.com.	10646	IN	A	204.46.43.184
pipcvsemnaher.com.	10646	IN	A	204.46.43.185
pipcvsemnaher.com.	10646	IN	A	204.46.43.186
pipcvsemnaher.com.	10646	IN	A	204.46.43.187
pipcvsemnaher.com.	10646	IN	A	204.46.43.188
pipcvsemnaher.com.	10646	IN	A	204.46.43.189
pipcvsemnaher.com.	10646	IN	A	204.46.43.190
pipcvsemnaher.com.	10646	IN	A	204.46.43.191
pipcvsemnaher.com.	10646	IN	A	204.46.43.19
pipcvsemnaher.com.	10646	IN	A	204.46.43.192
pipcvsemnaher.com.	10646	IN	A	204.46.43.193
pipcvsemnaher.com.	10646	IN	A	204.46.43.194
pipcvsemnaher.com.	10646	IN	A	204.46.43.195
pipcvsemnaher.com.	10646	IN	A	204.46.43.196
pipcvsemnaher.com.	10646	IN	A	204.46.43.197
pipcvsemnaher.com.	10646	IN	A	204.46.43.198
pipcvsemnaher.com.	10646	IN	A	204.46.43.199
pipcvsemnaher.com.	10646	IN	A	204.46.43.200
pipcvsemnaher.com.	10646	IN	A	204.46.43.201
pipcvsemnaher.com.	10646	IN	A	204.46.43.202
pipcvsemnaher.com.	10646	IN	A	204.46.43.203
pipcvsemnaher.com.	10646	IN	A	204.46.43.204
pipcvsemnaher.com.	10646	IN	A	204.46.43.205
pipcvsemnaher.com.	10646	IN	A	204.46.43.206
pipcvsemnaher.com.	10646	IN	A	204.46.43.207
pipcvsemnaher.com.	10646	IN	A	204.46.43.208
pipcvsemnaher.com.	10646	IN	A	204.46.43.209
pipcvsemnaher.com.	10646	IN	A	204.46.43.210
pipcvsemnaher.com.	10646	IN	A	204.46.43.211
pipcvsemnaher.com.	10646	IN	A	204.46.43.212
pipcvsemnaher.com.	10646	IN	A	204.46.43.213
pipcvsemnaher.com.	10646	IN	A	204.46.43.214
pipcvsemnaher.com.	10646	IN	A	204.46.43.215
pipcvsemnaher.com.	10646	IN	A	204.46.43.216
pipcvsemnaher.com.	10646	IN	A	204.46.43.217
pipcvsemnaher.com.	10646	IN	A	204.46.43.218
pipcvsemnaher.com.	10646	IN	A	204.46.43.219
pipcvsemnaher.com.	10646	IN	A	204.46.43.220
pipcvsemnaher.com.	10646	IN	A	204.46.43.221
pipcvsemnaher.com.	10646	IN	A	204.46.43.222
pipcvsemnaher.com.	10646	IN	A	204.46.43.223
pipcvsemnaher.com.	10646	IN	A	204.46.43.224
pipcvsemnaher.com.	10646	IN	A	204.46.43.225
pipcvsemnaher.com.	10646	IN	A	204.46.43.226
pipcvsemnaher.com.	10646	IN	A	204.46.43.227
pipcvsemnaher.com.	10646	IN	A	204.46.43.228
pipcvsemnaher.com.	10646	IN	A	204.46.43.229
pipcvsemnaher.com.	10646	IN	A	204.46.43.230
pipcvsemnaher.com.	10646	IN	A	204.46.43.231
pipcvsemnaher.com.	10646	IN	A	204.46.43.232
pipcvsemnaher.com.	10646	IN	A	204.46.43.233
pipcvsemnaher.com.	10646	IN	A	204.46.43.234
pipcvsemnaher.com.	10646	IN	A	204.46.43.235
pipcvsemnaher.com.	10646	IN	A	204.46.43.236
pipcvsemnaher.com.	10646	IN	A	204.46.43.237
pipcvsemnaher.com.	10646	IN	A	204.46.43.238
pipcvsemnaher.com.	10646	IN	A	204.46.43.239
pipcvsemnaher.com.	10646	IN	A	204.46.43.240
pipcvsemnaher.com.	10646	IN	A	217.70.184.38
pipcvsemnaher.com.	10646	IN	A	204.46.43.1
pipcvsemnaher.com.	10646	IN	A	204.46.43.2
pipcvsemnaher.com.	10646	IN	A	204.46.43.3
pipcvsemnaher.com.	10646	IN	A	204.46.43.4
pipcvsemnaher.com.	10646	IN	A	204.46.43.5
pipcvsemnaher.com.	10646	IN	A	204.46.43.6
pipcvsemnaher.com.	10646	IN	A	204.46.43.7
pipcvsemnaher.com.	10646	IN	A	204.46.43.8
pipcvsemnaher.com.	10646	IN	A	204.46.43.9
pipcvsemnaher.com.	10646	IN	A	204.46.43.10
pipcvsemnaher.com.	10646	IN	A	204.46.43.11
pipcvsemnaher.com.	10646	IN	A	204.46.43.12
pipcvsemnaher.com.	10646	IN	A	204.46.43.13
pipcvsemnaher.com.	10646	IN	A	204.46.43.14
pipcvsemnaher.com.	10646	IN	A	204.46.43.15
pipcvsemnaher.com.	10646	IN	A	204.46.43.16
pipcvsemnaher.com.	10646	IN	A	204.46.43.17
pipcvsemnaher.com.	10646	IN	A	204.46.43.18
pipcvsemnaher.com.	10646	IN	A	204.46.43.19
pipcvsemnaher.com.	10646	IN	A	204.46.43.20
pipcvsemnaher.com.	10646	IN	A	204.46.43.21
pipcvsemnaher.com.	10646	IN	A	204.46.43.22
pipcvsemnaher.com.	10646	IN	A	204.46.43.23
pipcvsemnaher.com.	10646	IN	A	204.46.43.24
pipcvsemnaher.com.	10646	IN	A	204.46.43.25
pipcvsemnaher.com.	10646	IN	A	204.46.43.26
pipcvsemnaher.com.	10646	IN	A	204.46.43.27
pipcvsemnaher.com.	10646	IN	A	204.46.43.28
pipcvsemnaher.com.	10646	IN	A	204.46.43.29
pipcvsemnaher.com.	10646	IN	A	204.46.43.30
pipcvsemnaher.com.	10646	IN	A	204.46.43.31
pipcvsemnaher.com.	10646	IN	A	204.46.43.32
pipcvsemnaher.com.	10646	IN	A	204.46.43.33
pipcvsemnaher.com.	10646	IN	A	204.46.43.34
pipcvsemnaher.com.	10646	IN	A	204.46.43.35
pipcvsemnaher.com.	10646	IN	A	204.46.43.36
pipcvsemnaher.com.	10646	IN	A	204.46.43.39
pipcvsemnaher.com.	10646	IN	A	204.46.43.40
pipcvsemnaher.com.	10646	IN	A	204.46.43.41
pipcvsemnaher.com.	10646	IN	A	204.46.43.42
pipcvsemnaher.com.	10646	IN	A	204.46.43.43
pipcvsemnaher.com.	10646	IN	A	204.46.43.44
pipcvsemnaher.com.	10646	IN	A	204.46.43.45
pipcvsemnaher.com.	10646	IN	A	204.46.43.46
pipcvsemnaher.com.	10646	IN	A	204.46.43.47
pipcvsemnaher.com.	10646	IN	A	204.46.43.48
pipcvsemnaher.com.	10646	IN	A	204.46.43.49
pipcvsemnaher.com.	10646	IN	A	204.46.43.50
pipcvsemnaher.com.	10646	IN	A	204.46.43.51
pipcvsemnaher.com.	10646	IN	A	204.46.43.52
pipcvsemnaher.com.	10646	IN	A	204.46.43.53
pipcvsemnaher.com.	10646	IN	A	204.46.43.54
pipcvsemnaher.com.	10646	IN	A	204.46.43.55
pipcvsemnaher.com.	10646	IN	A	204.46.43.56
pipcvsemnaher.com.	10646	IN	A	204.46.43.57
pipcvsemnaher.com.	10646	IN	A	204.46.43.58
pipcvsemnaher.com.	10646	IN	A	204.46.43.59
pipcvsemnaher.com.	10646	IN	A	204.46.43.60
pipcvsemnaher.com.	10646	IN	A	204.46.43.61
pipcvsemnaher.com.	10646	IN	A	204.46.43.62
pipcvsemnaher.com.	10646	IN	A	204.46.43.63
pipcvsemnaher.com.	10646	IN	MX	10 spool.mail.gandi.net.
pipcvsemnaher.com.	10646	IN	MX	50 fb.mail.gandi.net.
pipcvsemnaher.com.	10646	IN	SOA	a.dns.gandi.net. hostmaster.gandi.net. 1380795988 10800 3600 604800 10800

;; Query time: 6 msec
;; SERVER: ::1#53(::1)
;; WHEN: Sat Oct 19 22:07:47 JST 2013
;; MSG SIZE  rcvd: 4013

Observation of DNS Amplification Attack (bls.gov)

bls.gov's ANY becomes huge size because of DNSSEC. It is abused as DDoS.

$ dig @::1 bls.gov any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 bls.gov any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19603
;; flags: qr rd ra; QUERY: 1, ANSWER: 18, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;bls.gov.			IN	ANY

;; ANSWER SECTION:
bls.gov.		86142	IN	SOA	dcgate.bls.gov. blsdnsadmins.bls.gov. 2010042644 1800 300 604800 86400
bls.gov.		86142	IN	RRSIG	SOA 7 2 86400 20131026030030 20131019020030 4712 bls.gov. YeBVU1Ek4HocfJsCDiy5qFe9hCEtnaLGQ/jaX7NgXLsvJ6An1cw5yKLA Tb6fj+ZiOr9dWggrVSeZlzVLHonSv4EUjpLen2fXH1fyaOd9M4SpNk7W /5s+kORqNTLGmn9ubT+EIph8BzTlJ9+FWTjnAZjSJd9CniPVXMuShjL0 5A4s7fQVcvU7mNC0XKFiGrQFW9iiEH/zHAGHbG6nHDBaWzoDBey3Qgwq ojem7dspFWwedki0gXY4neOLMgXM5Ci/8LpXwy3zPIAXyqxTIzTq42yn E2gHBVONRx3auQbI9REYD1f1JZVo1WFzMdalOD0JMHhl9BOICrbmaqFQ 3QHaYQ==
bls.gov.		86142	IN	MX	50 blsmail1.bls.gov.
bls.gov.		86142	IN	MX	10 blsmail.bls.gov.
bls.gov.		86142	IN	RRSIG	MX 7 2 86400 20131026030030 20131019020030 4712 bls.gov. F63OMdDdiUBDY6E3a5g/X1VTm6tBLdQ7OJOshZMpn+ei5GBztYNJZuxT 83QSFMUpgKtq56u9WltrZJJTUfTojFfMosARO/cPaNVQEQPwt4xesXJy e0Rx4m9rhFD1z34AqAoeLod6HanRjhkuizkk6M/MNPmejYJTN4IvyVFC 80TnG6IP6+l/O8jUwvUDGqZh/7mK7+V1+/hY8rZclOTXZB+x+St5N661 YLug66TbssrGgwHUwheFn0s+YVQczdF4eAt1Zk1aCVzuQBq6B2MSe1Al MYs38qXS4h0VO3pxs91M8PTsYCac0JBrvjVG2wPySJOeW9kaNVyCWToQ E9ZPuA==
bls.gov.		86142	IN	A	146.142.4.22
bls.gov.		86142	IN	RRSIG	A 7 2 86400 20131026030030 20131019020030 4712 bls.gov. lTrxdXwGbM6at8ZONnHvKBPM5ieNbk6nRzCnvkRUL0E8Pig/y4B2LV6S QBhdwX5dEvn36YcACnWRSrcCBg/eu9Sr1up8M+2AL21m5p0TB8sc26qw xXZw9ugFcum5XbqgdXnCUuX72mmPorD02JpfnjOJMXbx3hb51mjCK/gc PxWZxFfjmPzZ5IXnGcuve3fiAZI4IK0gvuV9tq2vfSF2V/eRFbuqzY+7 tr2KUVczCANIVfcR6P/t/8C7RN2LgnYGMly6MLxjF3EbBl1OKEMxPmyI uumtFakMyoAO1krWykyVtQGYN6Oe+0fFGv3qTmzbWConfYxiUy/Zg/fj hCB3qQ==
bls.gov.		86142	IN	NS	auth111.ns.uu.net.
bls.gov.		86142	IN	NS	auth120.ns.uu.net.
bls.gov.		86142	IN	RRSIG	NS 7 2 86400 20131026030030 20131019020030 4712 bls.gov. JAtfq6M0Gk0pmzbivyqCZ3e5eOqJrBvMi6cxu/+3b8UEpR4OHy7zLG80 XyrudTz1fZnpLOt0mPVaXLg9PnwDYP47RtNFPzQBP2aYKqQFIwhiSfbG qRtczWGLJOMXRhbLpHOUEiDx3ST/dZH/SNxVFB9h0VkZSpsvxRIo4HYD H55V0O2HthpM4RrFRzyVxwKQN37e4nRC6i03D0krEEekPwFysfe4oWEl g2yHAPicSDDzvtxDDYhcSk3MPPW3FWhVB6xCbRNkpMu9cpnLAwpbzr76 GVSf5gaY+AXK1SS1G6mAxOOqSvlNLSfhmR0Upj8/YAXSD42e5WmVitZK IoYmeg==
bls.gov.		86142	IN	NSEC3PARAM 1 0 12 AABBCCDD
bls.gov.		86142	IN	RRSIG	NSEC3PARAM 7 2 86400 20131026030030 20131019020030 4712 bls.gov. WUyPQJrp4pxtNpIikv41yy3NxFg34+z6OEokuHenn7Vq8iqKPasSEf0F gCfSSdnV3ccKvXyfkedbl6wbME+JDLZytFYuoHf1aHDTm7tB2Enl6sc4 +EmC6z3sWkCxQl6fPCxcb4Qu4pEJ4UuIexcJqir24FyWkYEQkfEbESMG loiLvbW4YA89YUOMxXq9HBGGRWL3O0SJ3zqDzB03vFGzwSCoQ1sPSU4k RQiX4S8XstZVcj/4ZkUf+2Ys00FyzbfL31dZ3uEaFjojbP65ZU/2hFBT znLXcwXH3HPkw515jZ2+4ggsEWvev527rbeXHCETsnrvCOpMOuoYvcV1 T6TcRw==
bls.gov.		86142	IN	DNSKEY	257 3 7 AwEAAW7hTguez7A5q9hJHYUC2bm7HMlm4DKUxDYmEtx0ZAgdfkBDxEUQ tQEnjq5ffDGbNhT589xTEC7Z7LGpv4My8RL/+YHTwT7zLee+C1GJlfXw iItgB+lL3VKgD7YpSk7N355volXPv2nxB+LvxdEYHvuIpqUVhPKd6g7f juX/0R9aHMElX0zdiQdIIi+z9WoX9OTpbmAVD80PwZj5CqTviSBxv5Lr zZgC9PtJmJGDNRUL+i7ydL9czf2xjBVP1NvENvvrTCY5qUqZPTVde3KQ TQ75E4dcxu+KMpeEt/2jdAmrv2d+vcBvKN/2oKUtKRpQkAYqWbuHLoR1 +rLVWsKBhkE=
bls.gov.		86142	IN	DNSKEY	256 3 7 AwEAAWywfaLAmSpwAZal8y596M4jap8ioz+VQoaCYkR4yRknpKN7bSKx ZFTGCjPSaZbsM6RlMgSDOeRZdHdqrWyM2Qq6DVaiIlTK09YsyCK7WNd6 io4uNVGbjEo4Q6OM7iZmoDb/Em3Ymzz/CCRmik/qj9ayoko+FT2m0uYO k0LNzy4wYx2oiSx8HlkZGMItbfYQisNeW9XQG4wvQ7sTIEaySpZmCeFs 6quXEZsxE/jelTvT/xseSNSGRWfE1xFd+ln+LnNFyrFfEApMwjMkw9qf R3vMJMISgi75QnL2U/bCvHqAdxLP6JjN11FzH8wYWJ2eIkmcLAJ4y296 uA+8kacdZzc=
bls.gov.		86142	IN	DNSKEY	257 3 7 AwEAAYXURbzbBOatX1IZP/EsK8UpQRoFPZAuiqSSIE7JukxTpwukpPXB jCfLIsA059mSGkKFEaemeON8T9grMFjNjMl5EoDDuphmjI/6M9y1nPfI YcRould729Rsiw0HvOtN5YtMfbQ6beBhxxnF9mgvZ+TDhf3sRy4SFHws 7E1OT0NvGO1zbph7FnYgi09GZ/XK4CZHyXiQ3R8vv1r5PzIRQrK4xyS8 Kp128ozD0Wj7R1VolN3ZJ+tJWUYnXJe2S0CXRdZYQrPHK/AD3T6xjXee TlOSvLrpWdQtmlrnPsAQ/vuDKqAW0SqvBTjR2JNcaghwXorMgLt78fhm wBnerfn2QTk=
bls.gov.		86142	IN	DNSKEY	256 3 7 AwEAAafkOJX8jrccDObq1UmhKjSiaija4Be5fsbcQ+4RhBVZmaoO+jii EAmPJO/r26b4sYGRQ1f9t6W9UkMt53O6rkxQdWjag5EEpXs2XUmGic2z OYSS8IaIftikJFlulcgBsNyMFxunWG6epdjyfP6DOCrgI6X4ibtnJSbJ vfHVN1VlV/LkBSmxXQhcOnG/6Whv8iSkbNku77sSosjnQACULoPT96Sj dF/Pe1ar9cULJcx+QIvE8sazb6anEPZUqWwYbul3Co0rNV6WPMM1Q7Bn kJgS0490tJ+2xfmoyViELCGUJdhy+HAu7L6dvbUnlb9ZAcp79tAGfB8n y455crDim/M=
bls.gov.		86142	IN	RRSIG	DNSKEY 7 2 86400 20131026030030 20131019020030 4712 bls.gov. Sos3YBlFv6m058FZYcCy8QF5GAZ9m+WwiKkxPv43jFYvbQfsoTJbakkK yaHu9ontB/QyjSG1B0PNA97RX5H8hvWFxw0fs6p0xd/Nj6Xngmk9IKRI cKOzZKwR40gwGdo5nGG/60Y0ZET/S7SjJ4XNtTziqi7nNs90UQ5TpEIm CrGPw+QcNJqBhKuMf33b+lbC3XBlpyjRL8H+1+1kDEL9lRZZKdYjqb5U xn0YZI0mbhMw3KaPESS0bDkK2dlT0VyXHYG3HlsdrEMsAW4Q6AJb0Xmg RWxXllP8HiVUDWrUdt/5GAK2WCRiYEo7JlFmmC2dgDuKaPFWVzOGlpsk s27+zA==
bls.gov.		86142	IN	RRSIG	DNSKEY 7 2 86400 20131026030030 20131019020030 16984 bls.gov. MsZL7LnRanWiQLaGeXlwKu6wLumnZulErb4CisJQk6aretIpNiKzmLT4 JfuKfyYlnYp6cYai9KjPeKbAq31ARubNnEQiLzCgMUGqjpXOLUfJE3LB ZDIccgC+P+XwEjgiELLF0SCQ4HMy+O1OAKOpFtMKEeQkxBqygVu7+0ll LHvzfo5s2MWAeEbZ+BTsaWc/HD5PqGSeihyEHPr4Tm3CJZvrRXSJji9e OH6+TQWr7nBWpvZ9EQoNp0ErYt628Bc379YWlUdzyr3J8WGzHA9A6mhM 3K4Rg2sfiAnpzGB2gvA/6pDChSy5gOunn4gzoQPNHVTfPS2/i/zNAxg8 9GRnSw==

;; Query time: 1 msec
;; SERVER: ::1#53(::1)
;; WHEN: Sat Oct 19 22:02:51 JST 2013
;; MSG SIZE  rcvd: 3389

2013-10-15

Observation of DNS Amplification Attack (targeted GitHub)

2013-10-14 JST night, GitHub was targeted of a DNS amplification attack. The attack was performed about 1 hour.

f:id:ytakano:20131015232309p:image

Observation of DNS Amplification Attack (doc.gov)

DNSSEC makes doc.gov's DNS record huge.

$ dig @::1 doc.gov any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.5-P1 <<>> @::1 doc.gov any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39736
;; flags: qr rd ra; QUERY: 1, ANSWER: 49, AUTHORITY: 0, ADDITIONAL: 4

;; QUESTION SECTION:
;doc.gov.			IN	ANY

;; ANSWER SECTION:
doc.gov.		3596	IN	TXT	"MS=ms91611337"
doc.gov.		3596	IN	RRSIG	TXT 8 2 3600 20131030160345 20130930150345 4104 doc.gov. HBUNMz+F/HjNlEus0EmAeXR9xwzzSNz0B74FXhIXONngZtylwm7/sdtm i0yWvEm6HHq91KbpR5cKkhN55zjypmaSyBUI5J/0QR36iF3x7oJeCWgb RE+c1dTPo4tdlETll7UWiP7cR5J1uizv5oYI55J/5p0mVGsRnvJ8LqHC gWhr8KBa6Ngmz+FRrreFu/8i4D1BJpqvThCAKd5w4xKeV4jR9vQlsrbn kL19KPj7xd44UZNKS/Rhunyc+pgqxTWdLRsFxwV5bOeCk0KR0LRyLKuE vinEVO7WjYhWMpUlr8RJtzUJpPWZRzXZpvIA0DQqsJWyjB/KivSyWnjH EJ+DmA==
doc.gov.		3596	IN	RRSIG	TXT 8 2 3600 20131030160345 20130930150345 28725 doc.gov. at+1p8bFYT49WSK8+eLXw2ChRDwnGPt5fqYLgsHX/vOefvRLoRIQ6q0I UzUPi9piXhNLlwuAxcXms48irup0PZDCnItzGB1F0KIqS8/V43uN2p5Z +FzLt9xqevgBaor6HKcsxkt1v1C7zrgJkW/GLkZxArbm1wazwW2yzchU I/Epkfzt00FWQ4RIjG2X3McylnlyU8OMVwk+cZjia70LMIwPtuePaFN1 2Sbk5i4czUOV4CxNMmTojtSOphN9P1V7sv+1+iZERut2I4cJ5IDV9jlH lniXtYvWB7Dg1QdhySiTxPVMDLTP74xzokqIXBPbUBU7bdkQx6N8deLD iCgZeA==
doc.gov.		3596	IN	RRSIG	TXT 8 2 3600 20131108235505 20131009230007 23841 doc.gov. BpMjDXOSmLbsGM4mX2sx2B3aJ3fpv382GGx4eiYfS5rfvhkqZyAYPiXa WdbmLSgvVcanYxcKUT+lhoJDas7jQZdQkOXJjv78MQpMoYfdj/klqVRI pJ5OeSwu9Y4IP6koARJTZ3X1nU3f7Bay98SwLmXuFmP3ZRr90rEgGmCr Z7GXUtUfm05ZNKPUBLfMjiF1AghrC5HenvpZ42ujItvKMk79pU0EWefd f9q7w4wAsmOVtiSH1TmIxDAc8FtuUmvOcEq9Wwo9TXb2/DX0E7HRRTHJ jHjOM5j+gTQjt6OqZjPKhJQKjBfrjJp70EmjcKEysgu/+NKW1+HjSK+G Stts7g==
doc.gov.		10796	IN	SOA	hchbens1.doc.gov. dnsadmin.doc.gov. 2013100447 3600 10800 86400 3600
doc.gov.		10796	IN	RRSIG	SOA 8 2 10800 20131109000023 20131009230023 23841 doc.gov. eQJC2MAZYsVAAdmUPf2fjqiFnq1hv8iS4zuE42xJBy8BlzzNR3G2da9X xyMXQDcxLc+a1zHKIH1YjVYpcLKy9FXApj+LYScQwFR97tZ9VEZv3o2Y JfxAkb0hr+IE1ZTivgerRqC5E8zxyeG7ob4WBddH8B+rWhvSpwhP/DUz mWBLMhOMjNpMjZE+pypuq7ZUogbm0ILeVzkpGSPAn4gsqHLAqz83E9p2 ZGhCNPbfanc95ihX2A1mrIh2yUlSr5apu9LfpN0iZerhnVXrcSGz3ajj 6m1iAqT/4tjxD6RBFqovIbjQL+h6wZ6NXSr8r/XKTD4TLts9quvGn4QX bPRDdw==
doc.gov.		10796	IN	RRSIG	SOA 8 2 10800 20131109000023 20131009230023 28725 doc.gov. j9MfJf0rk729Sb8xkYwTdiP57oi4GWasEcPJjPrxh8dmX603h+XHcGgQ oh3nRY5UzLwn/Tdgd2r77NMTKfDif5Qy69X3H0LhFsIQsEZWOtiam/Ju GoHj40qRdJvOvCEE0qq6qH+XT8tnCzbzOsk5cFxvWV+xnmwWjEdQSifp OWK0darCgYpddnd7tRhd6YEiy3Eu/JD/nPIMZbnv06URsKYAdaBN3Ie/ 9ObdAWcME7JULTXrfWYbzvHmp0EGrsRAR/tdf1P7jNWPSHJzeml96TCN XXswh4LrtGkWmmIIW5MajqrkKh081cdzC9pUVfSQl6dJpAYRIj3ySpA4 q9rHlg==
doc.gov.		10800	IN	NS	dnssec9.datamtn.com.
doc.gov.		10800	IN	NS	dnssec7.datamtn.com.
doc.gov.		10800	IN	NS	hchbens1.doc.gov.
doc.gov.		10800	IN	NS	dnssec11.datamtn.com.
doc.gov.		10800	IN	NS	dnssec10.datamtn.com.
doc.gov.		10800	IN	NS	gpaens2.doc.gov.
doc.gov.		10800	IN	RRSIG	NS 8 2 10800 20131027025635 20130927023632 4104 doc.gov. Q9wjVRKQU2z5GrV531FH7shsGS7VlXqlaCaJtQN0nhzb0jsOSOI8jo/y /XSVh8nu9WxmlRQ8hJfLgadW0pILheCBqYJ94987EE8GQ7+OxFrrNNxb yRN5PtqYd0cJsG5ykImYc6XhWecLkddlq0CJ1LY3opJMY9ZMJJpKN0V1 oF2aOxSYjgF6GPLOSVYnC5tkoAgOpVB+29V6pYg8R2Xcd27JNZgX9WRH H7V7SmfctfJ5YDNmpOKORu4M49IqK4u+GvSGrtJQbw0sx1Sc7eRrL5ft 2TWHk7oyl/Zi+baA/0WZplirjIDXI6vkgbZ9sZ+V1yEZ0NTdyJQysDYs dapY2w==
doc.gov.		10800	IN	RRSIG	NS 8 2 10800 20131108235505 20131009230007 23841 doc.gov. pE9K55wLEo7KWiowiWStWtQlmQTw8+VFwdu3oKlO9lgFM5s0O0g9AXoS KUANC3db8Tj9B+35KbM3Ueq11nodv4CQd4sNMyjNnSaLGjYXSaFZjrQL L5iyxqFoDCPJgIUpVYer5xFKP4zuG1e3XkrgZxKMe9LLQr5SOG9k1hGL ZtNrWa4DStfgAWhhmCceXCFHIzs7m5QIsCo3GYtDCZWsMo9nArUBalbw K9aA6jzHPK/8ZCtOR0457dBGgC13koAu3dTIIX9uhGbLGSz1TSv5e9yB 3m9PM4759oY3TbdUK3zgrfBaULm3s4GfJAgn8kK25IKbAVVsRSJb5V+e g5fmJQ==
doc.gov.		10800	IN	RRSIG	NS 8 2 10800 20131108235505 20131009230007 28725 doc.gov. RsUngIXhpr0ZnBiirTwYFKXKIm18F0/y7P4e3HN+llGcXE3uJ7Ymhhkz dFQSHj/hC/knKH7H0NFpPLF9RjovnNsxYAFK8H3s5dIItEqDNDONl/0f g/FmQ9cMuNxQZha6ych7FYx+dUubu51ZokGi5C3zNIr9DxGCRHxovSrx 2WIHM2xeJNBjQQq1Ji/uYVdxU+l9Ja+/IBlYWDtaJb2W7vnsPxM8uxvP ir9DxJeepiKOw1QRmF8/VR4L8DRGtBgYgLf8QckGOBgkPrfBdkwzKISg wm5A9d+vAsQAOmZdV0qLqxp3HuTcA/GqHpG+Iz/Q99c1UvbTIGeqLWsL gySLXA==
doc.gov.		296	IN	A	170.110.225.194
doc.gov.		296	IN	RRSIG	A 8 2 300 20131026194457 20130926192258 4104 doc.gov. JVBUhLtP60HgozIkY3ByI6oKu13+LmtAuiqwVQ7oeHkrnTzMcjgaEobT laWxvVL9O0KjnzQDD9rwzBXEC3CBDIHYkybH44zRL5clHO16ibV3rz1v NL9awR/gmysVZAgH0aYwjS8Hdh1ZNWtxkKsWei+QF2uvO5lQixn57C1w BPsi6BbW6dJ9EfBCD9T9waUc7cIC08NTjbnH+UQwI/RYAAwUCG9hJ5/V E6ObJ9K9wUTfqwWdycRA27P6w5eMI8VKalIWn1UR4WqEMe6Hy05uk2MD HqAuuvo/knZzt2+1ZnSauknKFdaUKqO+g/d2Plu54lIid2FqIJpbGEv/ xoRQkw==
doc.gov.		296	IN	RRSIG	A 8 2 300 20131108235505 20131009230007 23841 doc.gov. T1yn5WucgczXJOiga5aiP+1IwSUSHilv/C7dBP30f9gWP53Wft/tv6hG OofbK9wIzGLEJ168Xf/jma+px63pntPOkGTUF7AL40kZkt1N3UHMlR9s Uq5r288UwGqv1AB9b74bc9QcChGTqxCcKKyHOkoVwLOnozrRYz7ThSM5 aWNGAjcxEmAVqzbKdOzJSJpqSwHXUDZ35gRhWL2/AwjgoQn/gmhxYlCX e9pN/HJEB6atwSFvchCdgiCRZpCNhF8nwFiVBw6RS7Sgle88mecjWzG8 hYTEEHxnN01fYDRNW4uRwdNatO68NO3ze45Vraqw0KMqOLHzJralNTig qrHsEw==
doc.gov.		296	IN	RRSIG	A 8 2 300 20131108235505 20131009230007 28725 doc.gov. H1qij1qPNAcf7d7mBEL3WFJ2+BIJWgEzaLDtM7NE+Lcjkjd/4MIrZcQB MUtLRabMWG7n74jwLuaFCJU/Jn/6mgGoOucUNAX4ID5nGS28dmuc/Txs kzw4/jHy+4f84GQhLYQx5LuOB8bA9FemWRHf5ZvZ5U2RFVy4h5k+Wn7l glfa3scDXK8gq19Oek9NfFcoB3kBlFec67SUrEo/zJFl+qOfskOeutYb rjaW+vncPPL8ZaoT1cjuYV3ZMYa8oxHEnh2/fO2Iq69+NBLcRPSii54s +CuDHYqQhk/4tIFPnLtphsBZbjYDhF+xpInhHAUgOAapgq+Gb56fxK4b MajEnw==
doc.gov.		10800	IN	MX	10 smtpedge2.uspto.gov.
doc.gov.		10800	IN	MX	10 smtpedge1.uspto.gov.
doc.gov.		10800	IN	RRSIG	MX 8 2 10800 20131027032408 20130927030443 4104 doc.gov. O3mvLFXwhnJd4e0HHYJI2mACDxpwt1GFMgHr8Ss5ll5KCfvBCQGwjAHS ToSdj97/luJRftqwYsG94MRlPcHsQjSxbyM3NICzs1UMeAB6gNHcsQrO vhdru4PykljgaLPCAyA56oRAsTkoYgFBkcgi3IxjdVgniVZ/Y4vN/o2d AOmt6lWZ1VopDPq/nxF0MOj++J9FNMYaPUtns3evOucnm+7qKI1RWBxS mrnsuHIZ3rgtW1H/FOcIrEOnVhRHLTk9OMmV55Pkv7fP5vsd6xu/uSJX sCAX0JUaBopJ8i4lg5S8zjIn+DQ6aT+C5+Arg/gFHQtsHy2UvoSGlWoc B41OfQ==
doc.gov.		10800	IN	RRSIG	MX 8 2 10800 20131108235505 20131009230007 23841 doc.gov. K+ejXZEY3XA0UFOUfsRdpAUFgqwrkR7GIBbnJDrs96a2SSfkMR0tnROD 9+nJaQu5q3k53lqEYVieu9AwSCtTznVi3kqzyUv/YvAgpXg40+bZcNWI +OaCb2MLa11gJK/w2C2bOafkg2yEmTyiyMPEu9C9FIjzWrpGrPS6t6nP r8TkTP52RNhJVZJ2ODZQpq8MkNs/yN6Fpqil1C6AcMkLJcOBSzxIyj/3 eXSzKQi1AywZLVuFJv5Lf0aZ4Y1zyU+HEEXbJRkNq+v3TxX9Oue4aCcm j7MlUeO6F8Ofnn4nD9PCqyBeg1hCnmb0wyXLCUhBE1N2YKZeo4azKm98 JTOrMg==
doc.gov.		10800	IN	RRSIG	MX 8 2 10800 20131108235505 20131009230007 28725 doc.gov. oFPIX/kvlLV+B5TbQGNBAhOQKwPxAjADz2MnIjaAsc4m9WYe8SrkTrsT y/ki+6vBUTPbiTRN0Rg509GmTWzo5zk2tLgDEkNXRzCEj5iAhYknMv6S spU8MGBIEVOloefJ+HVdygmtJJHc3iq13Vci0rY8HmDvZlFjhr9I0fqc CgT3zRGKVXg6jpropGDQc16mLnCGbQVDvqCqnBK8BMfQX/jb8Krl+2+U PvAAfz+yRD0u6M2GDL2pq5etnpNEViTVXUrODUZWygYQXnaxpReGJBGf LazPz7TfJ7TlF05LojbMmaGN655QMy63dSASMHtsH/mNfeOhX4s4Hjbv C3DWxA==
doc.gov.		10796	IN	AAAA	2610:20::20:5ec:d0c:d0c:d0c
doc.gov.		10796	IN	RRSIG	AAAA 8 2 10800 20131027030338 20130927022030 4104 doc.gov. TJKT2cZ+VnP4y6NLV2cB9XgSGyy+jfY3xZyNd7vj8AMXWkitvTc1qbst MdeYvh/qqGQFqdAAq8Lazemo6OtpLMJZ7xqH8iLdxPQTF41HpMsETxMv 9IhlsN8t+ivfpqwfvXNztkUO6o8UsfHpG+p/wBNA0UqcaznJtw9c75NJ VglihRmnSOLJCfVqXYgnnBDgEczBTEGKbj0zey0wv89gGjW8+kqUSWm3 h8gBLB0tRCnK5aBCLeArx82VReRhgPaz5BA5Zi3iW7Y90WfB5mzi0SL8 NirAInzZ9bSkQP+5nHpq7O6tXtWl4/3oC/f7FD4DrReK+Zegfr0JPk4s c/K3Xw==
doc.gov.		10796	IN	RRSIG	AAAA 8 2 10800 20131108235505 20131009230007 23841 doc.gov. emL4RANQiEj2X0h8K+HSToQ1CnpuuHEGW8oVrOdQdWdcKgJ0FBgUE9fA fq34RaxqJcp9zFnmgVLvjj9JIx9ZShNpuBQV8YvS6KsfXk3Umh6drWIn NYEvaMQLykgeJ4/CMh2HsFoHNWXOicV4G19XWAymPCzOHzBnZrSypkFt yZT49FNYGHMgA6oHoo/oZdQc3ecjQXUgqyXqp/VlV7v3UllS033UN/EU NY9fqbsoDSu5ykZxiPSHUA04S203IHjSti+75nPVpOXj+v0tH0at+/PW T5dQ/vLyOawwMo6iG+PVJmoiHqGlmhGOwgFaZkNFbdiB9dyvJ0iZqlJM yu7Muw==
doc.gov.		10796	IN	RRSIG	AAAA 8 2 10800 20131108235505 20131009230007 28725 doc.gov. b/7mq2nkYFzgvPJTO3wIi8wq/jA7ogOzxzizz3ANHsAiEDFHCroUe4fk 3vESISpf936noJbAA3hgdfRIUuK620etjBOADYutrhZnkIr043w9+hRm F2rRYmgi2SAhRXuMxmKhJtcrb0r/5rAqUfjwkj7PNAkkK6BBL1e0OfrE evLRQbiiD8AH4EUxN/IMvYM/0FmjsuVyFwmp4mxfgv0ElPx6d4yT9cCR jFH8B094Bnj7WiZuSG0C2OCQlyP/gW9Mmma06jj+8kQHaket0cVQZGDb mA00l5yj03ncMZPXKqD0QAP+rd7Yk1rOwODIrUN3wttbipo2hBN59+ym sSjC3w==
doc.gov.		3596	IN	NSEC	associate.doc.gov. A NS SOA MX TXT AAAA RRSIG NSEC DNSKEY TYPE65534
doc.gov.		3596	IN	RRSIG	NSEC 8 2 3600 20131030160345 20130930150345 4104 doc.gov. E+MGIryfKPIFRdzyxXliVAZIhNvgYCrCNaZ4kt5NGV0SJN/IzxdFKVy4 fI1JcShkTExOPWKHBGcFrU9EDbIHGMOoVkKWoBGcycd3DOnmX0WzoBuD fxDorSs6jzQaBCbsqVbNRF7wCaAB0YqN8DveWHqStB8XajYJfIGAs8wY TY84/LZBOwQ5RORH1Q0pdwUgC/LBq2oSjc5Zi/gdUxyAald3POs77DvY /lzYzIUazwh6G3gzUI0hRsuAK7f2USpVSlZRYVs7YG6I/8Vv87NA0Ft+ QaZOMdiTme4Z7aRsMOT/paqE6OogvGi2VaAC0qt3LzZv6pHD7ymXW3fH usXTHw==
doc.gov.		3596	IN	RRSIG	NSEC 8 2 3600 20131030160345 20130930150345 28725 doc.gov. JmdXK9512pTnh2h2YO4tThm5BQyTJNxe8u9wwwjmC4EyPPfKw+HwYhKJ +DRryKB7ZEc94sO3Alk8+GvTrXpjAwjuMdcocsuCANyRGrDxtm6P+wdT 5TUSUDdC+lX5k2R3eXaxK/RAszeQDV+wxgPvMv2Mad5nOTPtMwUhezOf j0x5OJVcmN4OkPlfzt81uxesU0uaps9M8GqpmNhAvmM7e3YS4qr8rftH DgJuY/GIWcPpI9EQdTaQHccRkTgCCymp1tdRvZJmbJDn0sAdHAvMi5N+ r/DuSX+TojeoFu6i1ECfS4UJtrkoteUw6PzXRBolcgoJ+MHDmKJ5IoPT JlD43Q==
doc.gov.		3596	IN	RRSIG	NSEC 8 2 3600 20131108235505 20131009230007 23841 doc.gov. G1h2buu5nRrKmuQPLBq0G12GWsWQ5V94pk+dTUR7vcGYYUuq9neqLqbZ Ld3yECp3gnBdd2g8CXzSMIVI7wQIxKQM83iTdaJ7/l5IbHgpn9IjTNRW 6NS95IbYJynmbRz+mHyOTMfgijkyTdIB96ItcO5SwQHbOynrcnnuk/TM gnJjjIrJP6scVoIipnW4ma/cvCZInsC2mSBbMKhTllfKNI+uXXqKfCTE gFLgPTvEZPKZcV9QNYEm5YRPGh1F4/RIbOPPhfrXZDPLrrW5mvEUwGpQ huGSxiEJ0AOU/nKt1YxQmavnCKoZkj4uDE5C2lw1NDbfshkJzz38wLpM M1g6PQ==
doc.gov.		300	IN	DNSKEY	257 3 8 AwEAAbA3KnbQK3ZcUJmHKV34rxd3AcUDqb9/emRLoh6Qb550Z5A+48NT R0q/xirDYsRIvRZs6N7H3VWO5QvMA38sH2K6KY61MMDnWpfAgcd02lrG c03QF05/nANdUtb5WEVXDJK+8FePJhf+j1jueSKOw6jqeL8KdhGLFcLN DvzrjwdVrs6Ixa6tr42gb0Fr57xmFbNOERRhtCDDvcIHYEQBXorelYKU v9ySME2Qsna3PIre0M5NDwsqBeLGZkCn48iyuhE3IGwvGZKitrs4jufs 0OfN55/fuhpzaHiCpRP8JPQqRoY4Lhskq9mIXNh+y6A3q4yl0T8B+hOo r2XklAkokYk=
doc.gov.		300	IN	DNSKEY	257 3 8 AwEAAb2jXTeniZY4v9JaSg1Md76iRi6Y/8Bh43dLfHCC61zFCG4lOKHt M3jIU1nma4AHvlYNqVjq4rLYjDBsZQzAXh27N3CFfdGMALTgZ61hO3We VrEUabJstDbqw25I5mkfg59gfzHjCM1uhdHMD2iC7n6f5zycCI61HNbk WEHJ305rrsWOascWPCF50/JXs7Q04J2qAJAxRjAELKrmNJCT4/d/0CaE fat9XA/nvWoS5OzT/QgK3DsVgR53vTzJ9c5cl59jF+JgSGyw+/EdpYze Gwf59qJyB4u8KZk842c482/H/bnoQ0Q6ts+244OcOBJVkkHUTP7daS3Q UlgT6e5kzfM=
doc.gov.		300	IN	DNSKEY	256 3 8 AwEAAcD3LBv2O8sp3fiHx9s0cZo5wOh2UNKg5N0diYe7EujuzTA2HP97 MBwCaZLeJ8dAS3AViePJEjJXtYfiIafwHXHu52DSS/vjp/pIQ60NQ71K rMlKRohQA0oZt/L4R2znws+s8vcL2ZxcILOXyNu6FagxT7rXIqaLg26C c/rZsDlkbhkBvh4fQKtJLozMTwEFyktBl0ooaOQbKJvkac716eSzYbN+ 74EvV6EUuwJ6asliVUDZ2YsrziRzO1szOlTbe9i4rC7x/tI6Vc3M0bM4 t/Apa4SGW7wJxJNmf+vvlvIr7Pb0h4+DTFN3q7Oxk6nFkYHDqr2mSF9m 8f47eClAoqU=
doc.gov.		300	IN	DNSKEY	256 3 8 AwEAAcIkXwpwcDoURP8Vp7wOenMsYecr2CCqFdOM2QKdLGlkwa++6xiW v0nce3+8Qwm/KJijcrAEGi25a3DdRfUTWtYkkdDCIlo++y7PY90KfwT5 mXGxjxLr3lNfo7fuSnhraRev7rQnIFKQh5F8hcGXvyP2138eBg/ghW1Z 5iG5L4gm1MQ0RZ27CaKpC0tPYKN1VgWn5eyqueWsXZ7W5zYyD30PTSj9 aYr1RDYenx7qMZlrUhOmTll+Pv/IFvFf8ERGrcjI3w5XY/MMphlc6O1T vro9m89PiowC6YBDPqaNQHo7oEbGo7CVLZEbjhFcgUkeyXp0duS0k/Re xXTyUuHiAJc=
doc.gov.		300	IN	DNSKEY	256 3 8 AwEAAdW/P0apWJJmmcu08l4mcWQCOB7jYgJ6gTgWihfQURpwDkNfb0Cg GXK1KTH7khFx3Ixaw3pNYJbSayO80RfHnp1ZoWELJb+yUMMOXGTaPsLt fGJlZhaeXtxmaKWQkpQVM2OJ47GNQCFysE9MO07tAM3xvTHrMPQ3C4pZ /Klbc7YsrDC6Sg0jR5OcZx95jBvM+mAa/6atQamp3Mc1ID3dPgHZaX5e JQc+MjQAzdYexMqfG8dnwjMDwIBL8dkzywZ/+g0ztpEyjxHailo+r5lM +Q3L3lw6bhBmaQyeB4SpdXfrUhKX8LDWYn09gYYtGB7eJQczUSN+OhXK I64wpzo6X4s=
doc.gov.		300	IN	DNSKEY	256 3 8 AwEAAeBP9cEQR3eTa4u1x3WpLwnCog7rw/l22hXgwiHZIjGAz26+l/cW +QEHS9bAlJnRtZhmlBYN72DvfpshuEL2o6hh2yVw7wcRC4fNOTxOeury wLrkKZQE0WC4fyaxlXJsIWRwLEb3H4YYQibGbPRWyGy1NDnapp/sj4AX 53p7RM2rHWcFc89KZ7vJMMzgmZF2v+jo96OGJU7g2Nu4vEZzj8iMJCT6 BGolQRVE/svYmrqdWpQoIJ/SCPIp//tkZlKo5J2JNwgO4H01ZPr+Bse3 mdznrJ33FYj2waOL8d9Km2GN3h6U8UhAS9GHUMc2IsjCF1GN6OdnC0KI s8KKshwLLK0=
doc.gov.		300	IN	RRSIG	DNSKEY 8 2 300 20131004000000 20130903230000 33255 doc.gov. DsXn9Lfi3cnRE/6W7nRHgczo5Y+MylyDpZSD6j4MslX76JXcArI4QiCH EE1CDPXDFiH5rz+MWrE2gtgpCZtN2Hq2vFWxRhiDRyCFVlAAV4k8snEd sK2D3P3RKn9omBswv3O5VMCUoG10imk/bkI1Zytwz2+7dffeK6SEvvBy hQPyauY2x2lO+vZJkMTUZy+5N3E2UhMkl53/5/kIMWLoM3BUtoLr1Seq wjFJQwiqCFwRho/cBv06/0Ra22nwR/MhOc10VThqmbYWzZMGuDhulm1p ddHvcSTzm78MGtp69CMRHvyxE6AHM3jPj9sITu4gPLWKm1pq+xs334db 0df++A==
doc.gov.		300	IN	RRSIG	DNSKEY 8 2 300 20131103000000 20131003230000 4104 doc.gov. DOdVnYMXn9fcRu5V4LGoME+v+v8Psjil3j+VYBp+i2t5+fJV4+4Eq88D xtWWyKYwMjDZZg4a95eP52LvSZbn5MwctKKk/DCSWkbzHc3ekq0yW08d pkolQBzapcVkn4PmUJU8l3x1TQj3Nho1e0TyE3QkWgVp3utOHHnQuUBm +uIByds7YHev05abcg58bRaNPJhLaZE+5Xt0Sefmru7whpC7yPhgJ0rf LbWX0npDBLneBJihOyarZ37atvOt8Kr0lILnSiBaRMxf1iW8IWha4dZ1 pXTjIXoW1Kx8Uo+dl+vPUY5oeBQZjNh8EMj4gFCYDZ9YwWQza6wjKnpU jqnmnA==
doc.gov.		300	IN	RRSIG	DNSKEY 8 2 300 20131109000003 20131009230003 23841 doc.gov. gCPukOzVS9AT+On4KrMwLku73A9sp7Vultp4H/yjYH2WRv3MjrguHSeF aDBcUQgRY/dVhMUWRWr7ByVdciXKRPllXuJpXoUgwFhppKK1LfkFNyi3 GGmWGNNlLLB+j3Z9H/h+X0DRoZPqqL9ghho0HScsbZ1FU8F/4UHHFMVK f3hMvirAQwcS1XGMgVeezIgD+XSIzEsuuJp3DZs2ooGWMmTPIlqM3+Af 2tRPoHGpGiMFjJ2dp87LDMFEoMlx63yTt61Bs9Tz7eVArkc3A37P2Z52 YWGEuFCs2aeyC3BmKnmYcyaA01H+3fs2ficjuaCkKAroMGGc+cO4nFZP W2i8RA==
doc.gov.		300	IN	RRSIG	DNSKEY 8 2 300 20131109000003 20131009230003 28725 doc.gov. Po1OuOENePs4gv27JWcHsOxCzGdvy2FRhWAfBsNhHgYpycT04vGPDx3j J5/E38HZp3LW914MAwgJIwvS7EkdkcZaGRUclG+e8Yg0gHp7cJbdnfyC z0PwYRS6FOvYoVbLQefgwL4+xprcpFZAhMUmAMtR/5fh4hQgSYW1SpFQ tYSxZZ3vMONy8pKEdSC4W6aW8LMvBX+SxIBJ3Aj4Q4VTUWnAYR1gXaUy yiCv87os3h8qWD1QA9gPNGC4rKUH04EsKxYs+y/ZR7UyPQc+/SpZTwag HD6npPIcVFrArQVphqo2pBeIphAaSIJ0P51DDH1s1i04xBi42kyscmOx P9wDdA==
doc.gov.		300	IN	RRSIG	DNSKEY 8 2 300 20131109000003 20131009230003 31474 doc.gov. mXvOc4TgBnDdCkL1BlRiaSiFXXzaaKxhf2N7+Yn69ArndB0bmZqRd3Im wxruY983ZtvnhlDbEoJeS5oEXOqVO9KUbutkXFJ4IpfjzzEAZg0uSoWV QdU/1wpFyPzTnChcbZ69U5JIm4vm4erQP0/D9VFlx4YwLexDi41wsX+b r2OJrGD3umJUyEqswAw54Q6KYfVSQmTz70YkPqWC37QModjxGPlkTH2b NLe8mukZf2gHp3lWk+siUlZ4n/iXht6pqrf0tLJzgpdiReIduWspBS8v PTJJNZ7p9nOP7lJRytBQFnO0mGRnKKrKljP8QRw8HYNAT+UA6Nr1XAj3 sQt2Ug==
doc.gov.		300	IN	RRSIG	DNSKEY 8 2 300 20131109000003 20131009230003 55204 doc.gov. fy5uD7LWRvsO0FmqTf6168l0njthFRDndxtBKFOkT5tbBHLU/xr3K0uG iKgxnhs0k0HTaXY01JpRENI5C725Qgh21BzRz7dXJ+KktsAHE9aLxJzZ /RiRcbsAL71EuFQfial82yIVqZ43SnrofB6076XXWOvitA/QObsGUN7g H0XzMXLa0gzUWqIu1Rh5qYI+ADB4R+7bDuMs02WxGHWXZVrcKLm54oYg I9hh9TKm6sLhmdr799+kZDOa3nA68fmS7Su5GiAM46rbWmG6kWH7OTGD 5qhoFrQFWcsG+h/1ZA4q4CZXCF4ynLUyrNMJ5SM1dw7LmO/EDntIQihY ecrBlQ==
doc.gov.		0	IN	TYPE65534 \# 5 087AF20001
doc.gov.		0	IN	TYPE65534 \# 5 08D7A40001
doc.gov.		0	IN	RRSIG	TYPE65534 8 2 0 20131108234134 20131009230023 23841 doc.gov. AT/tZ0Vlam0SAUonpd18/dtPmcP/nQSdrFOchE9seYH/i4tRAPn5K/gu AHjj2C8KzAtnAsk09B8NChHMALmln77OFxK2NRL/Qc0prCAscFUfwxbo 9LTbmD2l7FEii6Il1OavR6vNEyrOk0FOBFmIq1bAQHFx4ObslUKUwXej 7n+W1Jpvr4pT1TrMzJyBhWWPrEt1bQEJSrrVVDL5zIAeKbiGpvmgDNIR fjcB56Z7rwXN0zv+xAUx27wO6cHFb4nf8JJBoKOisVsN5p1bZNcih4c8 agIKIqLbNpBCsGNUywAA62KSWO5Paym8mnN1uZygXL7BD5fIZh9U5K8i H843ew==
doc.gov.		0	IN	RRSIG	TYPE65534 8 2 0 20131108234134 20131009230023 28725 doc.gov. o2sdRya4lYxDBQH5zchCHxMS7am2wXySr03WRQCaVDmLPrvahjpJYpIZ DnkhIjqqLGihPe+OGuMpH7sEwMgTRWL35R0GZPK7yq6HgO2LxJ4464kU CCsdyp4P7q7qg3jSQe+dk5ASkDzK0fm1m8vQjHzW0quo1sHvV2w1h9Zn sUCAV1znmlYrxbVWNqFOHf++sTi84q5nUSDzKt4oS2ZeptDBz59BPHyM NyyRpCDIUBN4PKKF1wUkuodGdKOq5xiev+C7Z1lTSPIGL0HVewRaNXwW EXfFnoEiN1bW6qcZQcmV7Al+rKWVej0bglos3btN/O3L5QnjK0qu+aa/ +jEnWw==

;; ADDITIONAL SECTION:
gpaens2.doc.gov.	10795	IN	A	170.110.225.13
gpaens2.doc.gov.	10795	IN	AAAA	2610:20::20:d0c:90c:225:223
hchbens1.doc.gov.	10796	IN	A	170.110.225.11
hchbens1.doc.gov.	10795	IN	AAAA	2610:20::20:d0c:90c:225:225

;; Query time: 3428 msec
;; SERVER: ::1#53(::1)
;; WHEN: Tue Oct 15 12:05:37 JST 2013
;; MSG SIZE  rcvd: 10456

2013-10-14

Observation of DNS Amplification Attack (36088.info)

NSes are same as NSes of aa.10781.info and 30259.info.

$ dig 36088.info any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.1-P1 <<>> 36088.info any
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18286
;; flags: qr rd ra; QUERY: 1, ANSWER: 259, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;36088.info.			IN	ANY

;; ANSWER SECTION:
36088.info.		5813	IN	A	208.202.103.141
36088.info.		5813	IN	A	208.202.103.142
36088.info.		5813	IN	A	208.202.103.143
36088.info.		5813	IN	A	208.202.103.144
36088.info.		5813	IN	A	208.202.103.145
36088.info.		5813	IN	A	208.202.103.146
36088.info.		5813	IN	A	208.202.103.147
36088.info.		5813	IN	A	208.202.103.148
36088.info.		5813	IN	A	208.202.103.149
36088.info.		5813	IN	A	208.202.103.150
36088.info.		5813	IN	A	208.202.103.151
36088.info.		5813	IN	A	208.202.103.152
36088.info.		5813	IN	A	208.202.103.153
36088.info.		5813	IN	A	208.202.103.154
36088.info.		5813	IN	A	208.202.103.155
36088.info.		5813	IN	A	208.202.103.156
36088.info.		5813	IN	A	208.202.103.157
36088.info.		5813	IN	A	208.202.103.158
36088.info.		5813	IN	A	208.202.103.159
36088.info.		5813	IN	A	208.202.103.160
36088.info.		5813	IN	A	208.202.103.161
36088.info.		5813	IN	A	208.202.103.162
36088.info.		5813	IN	A	208.202.103.163
36088.info.		5813	IN	A	208.202.103.164
36088.info.		5813	IN	A	208.202.103.165
36088.info.		5813	IN	A	208.202.103.166
36088.info.		5813	IN	A	208.202.103.167
36088.info.		5813	IN	A	208.202.103.168
36088.info.		5813	IN	A	208.202.103.169
36088.info.		5813	IN	A	208.202.103.170
36088.info.		5813	IN	A	208.202.103.171
36088.info.		5813	IN	A	208.202.103.172
36088.info.		5813	IN	A	208.202.103.173
36088.info.		5813	IN	A	208.202.103.174
36088.info.		5813	IN	A	208.202.103.175
36088.info.		5813	IN	A	208.202.103.176
36088.info.		5813	IN	A	208.202.103.177
36088.info.		5813	IN	A	208.202.103.178
36088.info.		5813	IN	A	208.202.103.179
36088.info.		5813	IN	A	208.202.103.180
36088.info.		5813	IN	A	208.202.103.181
36088.info.		5813	IN	A	208.202.103.182
36088.info.		5813	IN	A	208.202.103.183
36088.info.		5813	IN	A	208.202.103.184
36088.info.		5813	IN	A	208.202.103.185
36088.info.		5813	IN	A	208.202.103.186
36088.info.		5813	IN	A	208.202.103.187
36088.info.		5813	IN	A	208.202.103.188
36088.info.		5813	IN	A	208.202.103.189
36088.info.		5813	IN	A	208.202.103.190
36088.info.		5813	IN	A	208.202.103.191
36088.info.		5813	IN	A	208.202.103.192
36088.info.		5813	IN	A	208.202.103.193
36088.info.		5813	IN	A	208.202.103.194
36088.info.		5813	IN	A	208.202.103.195
36088.info.		5813	IN	A	208.202.103.196
36088.info.		5813	IN	A	208.202.103.197
36088.info.		5813	IN	A	208.202.103.198
36088.info.		5813	IN	A	208.202.103.199
36088.info.		5813	IN	A	208.202.103.200
36088.info.		5813	IN	A	208.202.102.100
36088.info.		5813	IN	A	208.202.102.101
36088.info.		5813	IN	A	208.202.102.102
36088.info.		5813	IN	A	208.202.102.103
36088.info.		5813	IN	A	208.202.102.104
36088.info.		5813	IN	A	208.202.102.105
36088.info.		5813	IN	A	208.202.102.106
36088.info.		5813	IN	A	208.202.102.107
36088.info.		5813	IN	A	208.202.102.108
36088.info.		5813	IN	A	208.202.102.109
36088.info.		5813	IN	A	208.202.102.110
36088.info.		5813	IN	A	208.202.102.111
36088.info.		5813	IN	A	208.202.102.112
36088.info.		5813	IN	A	208.202.102.113
36088.info.		5813	IN	A	208.202.102.114
36088.info.		5813	IN	A	208.202.102.115
36088.info.		5813	IN	A	208.202.102.116
36088.info.		5813	IN	A	208.202.102.117
36088.info.		5813	IN	A	208.202.102.118
36088.info.		5813	IN	A	208.202.102.119
36088.info.		5813	IN	A	208.202.102.120
36088.info.		5813	IN	A	208.202.102.121
36088.info.		5813	IN	A	208.202.102.122
36088.info.		5813	IN	A	208.202.102.123
36088.info.		5813	IN	A	208.202.102.124
36088.info.		5813	IN	A	208.202.102.125
36088.info.		5813	IN	A	208.202.102.126
36088.info.		5813	IN	A	208.202.102.127
36088.info.		5813	IN	A	208.202.102.128
36088.info.		5813	IN	A	208.202.102.129
36088.info.		5813	IN	A	208.202.102.130
36088.info.		5813	IN	A	208.202.102.131
36088.info.		5813	IN	A	208.202.102.132
36088.info.		5813	IN	A	208.202.102.133
36088.info.		5813	IN	A	208.202.102.134
36088.info.		5813	IN	A	208.202.102.135
36088.info.		5813	IN	A	208.202.102.136
36088.info.		5813	IN	A	208.202.102.137
36088.info.		5813	IN	A	208.202.102.138
36088.info.		5813	IN	A	208.202.102.139
36088.info.		5813	IN	A	208.202.102.140
36088.info.		5813	IN	A	208.202.102.141
36088.info.		5813	IN	A	208.202.102.142
36088.info.		5813	IN	A	208.202.102.143
36088.info.		5813	IN	A	208.202.102.144
36088.info.		5813	IN	A	208.202.102.145
36088.info.		5813	IN	A	208.202.102.146
36088.info.		5813	IN	A	208.202.102.147
36088.info.		5813	IN	A	208.202.102.148
36088.info.		5813	IN	A	208.202.102.149
36088.info.		5813	IN	A	208.202.102.150
36088.info.		5813	IN	A	208.202.102.151
36088.info.		5813	IN	A	208.202.102.152
36088.info.		5813	IN	A	208.202.102.153
36088.info.		5813	IN	A	208.202.102.154
36088.info.		5813	IN	A	208.202.102.155
36088.info.		5813	IN	A	208.202.102.156
36088.info.		5813	IN	A	208.202.102.157
36088.info.		5813	IN	A	208.202.102.158
36088.info.		5813	IN	A	208.202.102.159
36088.info.		5813	IN	A	208.202.102.160
36088.info.		5813	IN	A	208.202.102.161
36088.info.		5813	IN	A	208.202.102.162
36088.info.		5813	IN	A	208.202.102.163
36088.info.		5813	IN	A	208.202.102.164
36088.info.		5813	IN	A	208.202.102.165
36088.info.		5813	IN	A	208.202.102.166
36088.info.		5813	IN	A	208.202.102.167
36088.info.		5813	IN	A	208.202.102.168
36088.info.		5813	IN	A	208.202.102.169
36088.info.		5813	IN	A	208.202.102.170
36088.info.		5813	IN	A	208.202.102.171
36088.info.		5813	IN	A	208.202.102.172
36088.info.		5813	IN	A	208.202.102.173
36088.info.		5813	IN	A	208.202.102.174
36088.info.		5813	IN	A	208.202.102.175
36088.info.		5813	IN	A	208.202.102.176
36088.info.		5813	IN	A	208.202.102.177
36088.info.		5813	IN	A	208.202.102.178
36088.info.		5813	IN	A	208.202.102.179
36088.info.		5813	IN	A	208.202.102.180
36088.info.		5813	IN	A	208.202.102.181
36088.info.		5813	IN	A	208.202.102.182
36088.info.		5813	IN	A	208.202.102.183
36088.info.		5813	IN	A	208.202.102.184
36088.info.		5813	IN	A	208.202.102.185
36088.info.		5813	IN	A	208.202.102.186
36088.info.		5813	IN	A	208.202.102.187
36088.info.		5813	IN	A	208.202.102.188
36088.info.		5813	IN	A	208.202.102.189
36088.info.		5813	IN	A	208.202.102.190
36088.info.		5813	IN	A	208.202.102.191
36088.info.		5813	IN	A	208.202.102.192
36088.info.		5813	IN	A	208.202.102.193
36088.info.		5813	IN	A	208.202.102.194
36088.info.		5813	IN	A	208.202.102.195
36088.info.		5813	IN	A	208.202.102.196
36088.info.		5813	IN	A	208.202.102.197
36088.info.		5813	IN	A	208.202.102.198
36088.info.		5813	IN	A	208.202.102.199
36088.info.		5813	IN	A	208.202.102.200
36088.info.		5813	IN	A	208.202.102.201
36088.info.		5813	IN	A	208.202.102.202
36088.info.		5813	IN	A	208.202.102.203
36088.info.		5813	IN	A	208.202.102.204
36088.info.		5813	IN	A	208.202.102.205
36088.info.		5813	IN	A	208.202.102.206
36088.info.		5813	IN	A	208.202.102.207
36088.info.		5813	IN	A	208.202.102.208
36088.info.		5813	IN	A	208.202.102.209
36088.info.		5813	IN	A	208.202.102.210
36088.info.		5813	IN	A	208.202.102.211
36088.info.		5813	IN	A	208.202.102.212
36088.info.		5813	IN	A	208.202.102.213
36088.info.		5813	IN	A	208.202.102.214
36088.info.		5813	IN	A	208.202.102.215
36088.info.		5813	IN	A	208.202.102.216
36088.info.		5813	IN	A	208.202.102.217
36088.info.		5813	IN	A	208.202.102.218
36088.info.		5813	IN	A	208.202.102.219
36088.info.		5813	IN	A	208.202.102.220
36088.info.		5813	IN	A	208.202.102.221
36088.info.		5813	IN	A	208.202.102.222
36088.info.		5813	IN	A	208.202.102.223
36088.info.		5813	IN	A	208.202.102.224
36088.info.		5813	IN	A	208.202.102.225
36088.info.		5813	IN	A	208.202.102.226
36088.info.		5813	IN	A	208.202.102.227
36088.info.		5813	IN	A	208.202.102.228
36088.info.		5813	IN	A	208.202.102.229
36088.info.		5813	IN	A	208.202.102.230
36088.info.		5813	IN	A	208.202.102.231
36088.info.		5813	IN	A	208.202.102.232
36088.info.		5813	IN	A	208.202.102.233
36088.info.		5813	IN	A	208.202.102.234
36088.info.		5813	IN	A	208.202.102.235
36088.info.		5813	IN	A	208.202.102.236
36088.info.		5813	IN	A	208.202.102.237
36088.info.		5813	IN	A	208.202.102.238
36088.info.		5813	IN	A	208.202.102.239
36088.info.		5813	IN	A	208.202.102.240
36088.info.		5813	IN	A	208.202.102.241
36088.info.		5813	IN	A	208.202.102.242
36088.info.		5813	IN	A	208.202.102.243
36088.info.		5813	IN	A	208.202.102.244
36088.info.		5813	IN	A	208.202.102.245
36088.info.		5813	IN	A	208.202.102.246
36088.info.		5813	IN	A	208.202.102.247
36088.info.		5813	IN	A	208.202.102.248
36088.info.		5813	IN	A	208.202.102.249
36088.info.		5813	IN	A	208.202.102.250
36088.info.		5813	IN	A	208.202.102.251
36088.info.		5813	IN	A	208.202.102.252
36088.info.		5813	IN	A	208.202.102.253
36088.info.		5813	IN	A	208.202.102.254
36088.info.		5813	IN	A	208.202.103.100
36088.info.		5813	IN	A	208.202.103.101
36088.info.		5813	IN	A	208.202.103.102
36088.info.		5813	IN	A	208.202.103.103
36088.info.		5813	IN	A	208.202.103.104
36088.info.		5813	IN	A	208.202.103.105
36088.info.		5813	IN	A	208.202.103.106
36088.info.		5813	IN	A	208.202.103.107
36088.info.		5813	IN	A	208.202.103.108
36088.info.		5813	IN	A	208.202.103.109
36088.info.		5813	IN	A	208.202.103.110
36088.info.		5813	IN	A	208.202.103.111
36088.info.		5813	IN	A	208.202.103.112
36088.info.		5813	IN	A	208.202.103.113
36088.info.		5813	IN	A	208.202.103.114
36088.info.		5813	IN	A	208.202.103.115
36088.info.		5813	IN	A	208.202.103.116
36088.info.		5813	IN	A	208.202.103.117
36088.info.		5813	IN	A	208.202.103.118
36088.info.		5813	IN	A	208.202.103.119
36088.info.		5813	IN	A	208.202.103.120
36088.info.		5813	IN	A	208.202.103.121
36088.info.		5813	IN	A	208.202.103.122
36088.info.		5813	IN	A	208.202.103.123
36088.info.		5813	IN	A	208.202.103.124
36088.info.		5813	IN	A	208.202.103.125
36088.info.		5813	IN	A	208.202.103.126
36088.info.		5813	IN	A	208.202.103.127
36088.info.		5813	IN	A	208.202.103.128
36088.info.		5813	IN	A	208.202.103.129
36088.info.		5813	IN	A	208.202.103.130
36088.info.		5813	IN	A	208.202.103.131
36088.info.		5813	IN	A	208.202.103.132
36088.info.		5813	IN	A	208.202.103.133
36088.info.		5813	IN	A	208.202.103.134
36088.info.		5813	IN	A	208.202.103.135
36088.info.		5813	IN	A	208.202.103.136
36088.info.		5813	IN	A	208.202.103.137
36088.info.		5813	IN	A	208.202.103.138
36088.info.		5813	IN	A	208.202.103.139
36088.info.		5813	IN	A	208.202.103.140
36088.info.		7013	IN	SOA	ns1.sdfre.info. root.ns1.36088.info. 20091027 28800 600 604800 86400
36088.info.		7012	IN	NS	ns2.sdfre.info.
36088.info.		7012	IN	NS	ns1.sdfre.info.

;; Query time: 12 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Oct 14 16:09:27 2013
;; MSG SIZE  rcvd: 4211
$ dig ns1.sdfre.info

; <<>> DiG 9.8.1-P1 <<>> ns1.sdfre.info
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38241
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 3

;; QUESTION SECTION:
;ns1.sdfre.info.			IN	A

;; ANSWER SECTION:
ns1.sdfre.info.		371	IN	A	64.62.186.77
ns1.sdfre.info.		371	IN	A	162.212.182.163
ns1.sdfre.info.		371	IN	A	162.212.182.165

;; AUTHORITY SECTION:
sdfre.info.		6971	IN	NS	ns2.sdfre.info.
sdfre.info.		6971	IN	NS	ns1.sdfre.info.

;; ADDITIONAL SECTION:
ns2.sdfre.info.		371	IN	A	162.212.182.165
ns2.sdfre.info.		371	IN	A	64.62.186.77
ns2.sdfre.info.		371	IN	A	162.212.182.163

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Oct 14 16:14:18 2013
;; MSG SIZE  rcvd: 160
$ whois 64.62.186.77

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=64.62.186.77?showDetails=true&showARIN=false&ext=netref2
#


# start

NetRange:       64.62.128.0 - 64.62.255.255
CIDR:           64.62.128.0/17
OriginAS:       AS6939
NetName:        HURRICANE-4
NetHandle:      NET-64-62-128-0-1
Parent:         NET-64-0-0-0-0
NetType:        Direct Allocation
Comment:        ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:        2002-08-27
Updated:        2012-02-24
Ref:            http://whois.arin.net/rest/net/NET-64-62-128-0-1

OrgName:        Hurricane Electric, Inc.
OrgId:          HURC
Address:        760 Mission Court
City:           Fremont
StateProv:      CA
PostalCode:     94539
Country:        US
RegDate:        
Updated:        2011-04-13
Ref:            http://whois.arin.net/rest/org/HURC

ReferralServer: rwhois://rwhois.he.net:4321

OrgAbuseHandle: ABUSE1036-ARIN
OrgAbuseName:   Abuse Department
OrgAbusePhone:  +1-510-580-4100 
OrgAbuseEmail:  abuse@he.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE1036-ARIN

OrgTechHandle: ZH17-ARIN
OrgTechName:   Hurricane Electric
OrgTechPhone:  +1-510-580-4100 
OrgTechEmail:  hostmaster@he.net
OrgTechRef:    http://whois.arin.net/rest/poc/ZH17-ARIN

RTechHandle: ZH17-ARIN
RTechName:   Hurricane Electric
RTechPhone:  +1-510-580-4100 
RTechEmail:  hostmaster@he.net
RTechRef:    http://whois.arin.net/rest/poc/ZH17-ARIN

RAbuseHandle: ABUSE1036-ARIN
RAbuseName:   Abuse Department
RAbusePhone:  +1-510-580-4100 
RAbuseEmail:  abuse@he.net
RAbuseRef:    http://whois.arin.net/rest/poc/ABUSE1036-ARIN

RNOCHandle: ZH17-ARIN
RNOCName:   Hurricane Electric
RNOCPhone:  +1-510-580-4100 
RNOCEmail:  hostmaster@he.net
RNOCRef:    http://whois.arin.net/rest/poc/ZH17-ARIN

# end


# start

NetRange:       64.62.186.0 - 64.62.186.255
CIDR:           64.62.186.0/24
OriginAS:       AS62466
NetName:        CLEARDDOS-DC1002-403EBA00
NetHandle:      NET-64-62-186-0-1
Parent:         NET-64-62-128-0-1
NetType:        Reallocated
Comment:        www.clear-ddos.com
RegDate:        2013-08-13
Updated:        2013-08-18
Ref:            http://whois.arin.net/rest/net/NET-64-62-186-0-1

OrgName:        ClearDDoS Technologies
OrgId:          GFSL-6
Address:        215-5625 Senlac Street
City:           Vancouver
StateProv:      BC
PostalCode:     V5R-6G8
Country:        CA
RegDate:        2012-10-12
Updated:        2013-09-09
Comment:        www.clear-ddos.com
Ref:            http://whois.arin.net/rest/org/GFSL-6

OrgTechHandle: DAIDE-ARIN
OrgTechName:   Dai, Dennis 
OrgTechPhone:  +1-604-639-7533 
OrgTechEmail:  support@clear-ddos.com
OrgTechRef:    http://whois.arin.net/rest/poc/DAIDE-ARIN

OrgAbuseHandle: DAIDE-ARIN
OrgAbuseName:   Dai, Dennis 
OrgAbusePhone:  +1-604-639-7533 
OrgAbuseEmail:  support@clear-ddos.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/DAIDE-ARIN

OrgNOCHandle: DAIDE-ARIN
OrgNOCName:   Dai, Dennis 
OrgNOCPhone:  +1-604-639-7533 
OrgNOCEmail:  support@clear-ddos.com
OrgNOCRef:    http://whois.arin.net/rest/poc/DAIDE-ARIN

# end



#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#



rwhois.he.net:4321 への照会をみつけました

%rwhois V-1.5:0012b7:01 ops.he.net (HE-RWHOISd v:r255,m1:r319)
network:ID;I:NET-64.62.186.0/24
network:Auth-Area:nets
network:Class-Name:network
network:Network-Name;I:NET-64.62.186.0/24
network:Parent;I:NET-64.62.128.0/17
network:IP-Network:64.62.186.0/24
network:Org-Contact;I:POC-DC-1002
network:Tech-Contact;I:POC-HE-NOC
network:Abuse-Contact;I:POC-HE-ABUSE
network:NOC-Contact;I:POC-HE-NOC
network:Created:20130807203009000
network:Updated:20130807203009000

contact:ID;I:POC-DC-1002
contact:Auth-Area:contacts
contact:Class-Name:contact
contact:Name:Guoqiang Dai
contact:Company:Clear DDoS
contact:Street-Address:215-5625 Senlac St.
contact:City:Vancouver
contact:Province:BC
contact:Postal-Code:V5R-6G8
contact:Country-Code:CA
contact:Phone:604-639-7533
contact:E-Mail:ddai@ddai.net
contact:Created:20130807163002000
contact:Updated:20130807163002000

contact:ID;I:POC-HE-NOC
contact:Auth-Area:contacts
contact:Class-Name:contact
contact:Name:Network Operations Center
contact:Company:Hurricane Electric
contact:Street-Address:760 Mission Ct
contact:City:Fremont
contact:Province:CA
contact:Postal-Code:94539
contact:Country-Code:US
contact:Phone:+1-510-580-4100
contact:E-Mail:noc@he.net
contact:Created:20100901200738000
contact:Updated:20100901200738000

contact:ID;I:POC-HE-ABUSE
contact:Auth-Area:contacts
contact:Class-Name:contact
contact:Name:Abuse Department
contact:Company:Hurricane Electric
contact:Street-Address:760 Mission Ct
contact:City:Fremont
contact:Province:CA
contact:Postal-Code:94539
contact:Country-Code:US
contact:Phone:+1-510-580-4100
contact:E-Mail:abuse@he.net
contact:Created:20100901200738000
contact:Updated:20100901200738000
contact:Comment:For email abuse (spam) only
$ whois 162.212.182.163

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=162.212.182.163?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       162.212.180.0 - 162.212.183.255
CIDR:           162.212.180.0/22
OriginAS:       AS26484
NetName:        HOSTSPACE
NetHandle:      NET-162-212-180-0-1
Parent:         NET-162-0-0-0-0
NetType:        Direct Allocation
RegDate:        2013-05-22
Updated:        2013-05-22
Ref:            http://whois.arin.net/rest/net/NET-162-212-180-0-1

OrgName:        HOSTSPACE NETWORKS LLC
OrgId:          HNL-17
Address:        1788 SIERRA LEONE AVE #108-100
City:           ROWLAND HEIGHTS
StateProv:      CA
PostalCode:     91748
Country:        US
RegDate:        2012-09-24
Updated:        2013-05-23
Ref:            http://whois.arin.net/rest/org/HNL-17

OrgTechHandle: ZHOUM4-ARIN
OrgTechName:   Zhou, Mike 
OrgTechPhone:  +1-626-248-6372 
OrgTechEmail:  admin@hostspaces.net
OrgTechRef:    http://whois.arin.net/rest/poc/ZHOUM4-ARIN

OrgAbuseHandle: ZHOUM4-ARIN
OrgAbuseName:   Zhou, Mike 
OrgAbusePhone:  +1-626-248-6372 
OrgAbuseEmail:  admin@hostspaces.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/ZHOUM4-ARIN

OrgNOCHandle: ZHOUM4-ARIN
OrgNOCName:   Zhou, Mike 
OrgNOCPhone:  +1-626-248-6372 
OrgNOCEmail:  admin@hostspaces.net
OrgNOCRef:    http://whois.arin.net/rest/poc/ZHOUM4-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

2013-10-11

Observation of DNS Amplification Attack (babywow.co.uk)

babywow.co.uk has characteristic TXT records. NSs of babywow.co.uk are same as NSs of zaikapaika.com I observed before.

a.dns.gandi.net


b.dns.gandi.net, c.dns.gandi.net

$ dig babywow.co.uk any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.1-P1 <<>> babywow.co.uk any
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17366
;; flags: qr rd ra; QUERY: 1, ANSWER: 246, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;babywow.co.uk.			IN	ANY

;; ANSWER SECTION:
babywow.co.uk.		10124	IN	NS	b.dns.gandi.net.
babywow.co.uk.		10124	IN	NS	a.dns.gandi.net.
babywow.co.uk.		10124	IN	NS	c.dns.gandi.net.
babywow.co.uk.		10124	IN	SOA	a.dns.gandi.net. hostmaster.gandi.net. 1381033702 10800 3600 604800 10800
babywow.co.uk.		604124	IN	A	204.46.43.157
babywow.co.uk.		604124	IN	A	204.46.43.158
babywow.co.uk.		604124	IN	A	204.46.43.159
babywow.co.uk.		604124	IN	A	204.46.43.16
babywow.co.uk.		604124	IN	A	204.46.43.160
babywow.co.uk.		604124	IN	A	204.46.43.161
babywow.co.uk.		604124	IN	A	204.46.43.162
babywow.co.uk.		604124	IN	A	204.46.43.163
babywow.co.uk.		604124	IN	A	204.46.43.164
babywow.co.uk.		604124	IN	A	204.46.43.165
babywow.co.uk.		604124	IN	A	204.46.43.166
babywow.co.uk.		604124	IN	A	204.46.43.167
babywow.co.uk.		604124	IN	A	204.46.43.168
babywow.co.uk.		604124	IN	A	204.46.43.169
babywow.co.uk.		604124	IN	A	204.46.43.17
babywow.co.uk.		604124	IN	A	204.46.43.170
babywow.co.uk.		604124	IN	A	204.46.43.171
babywow.co.uk.		604124	IN	A	204.46.43.172
babywow.co.uk.		604124	IN	A	204.46.43.173
babywow.co.uk.		604124	IN	A	204.46.43.174
babywow.co.uk.		604124	IN	A	204.46.43.175
babywow.co.uk.		604124	IN	A	204.46.43.176
babywow.co.uk.		604124	IN	A	204.46.43.177
babywow.co.uk.		604124	IN	A	204.46.43.178
babywow.co.uk.		604124	IN	A	204.46.43.179
babywow.co.uk.		604124	IN	A	204.46.43.18
babywow.co.uk.		604124	IN	A	204.46.43.180
babywow.co.uk.		604124	IN	A	204.46.43.181
babywow.co.uk.		604124	IN	A	204.46.43.182
babywow.co.uk.		604124	IN	A	204.46.43.183
babywow.co.uk.		604124	IN	A	204.46.43.184
babywow.co.uk.		604124	IN	A	204.46.43.185
babywow.co.uk.		604124	IN	A	204.46.43.186
babywow.co.uk.		604124	IN	A	204.46.43.187
babywow.co.uk.		604124	IN	A	204.46.43.188
babywow.co.uk.		604124	IN	A	204.46.43.189
babywow.co.uk.		604124	IN	A	204.46.43.19
babywow.co.uk.		604124	IN	A	204.46.43.190
babywow.co.uk.		604124	IN	A	204.46.43.191
babywow.co.uk.		604124	IN	A	204.46.43.192
babywow.co.uk.		604124	IN	A	204.46.43.193
babywow.co.uk.		604124	IN	A	204.46.43.194
babywow.co.uk.		604124	IN	A	204.46.43.195
babywow.co.uk.		604124	IN	A	204.46.43.196
babywow.co.uk.		604124	IN	A	204.46.43.197
babywow.co.uk.		604124	IN	A	204.46.43.198
babywow.co.uk.		604124	IN	A	204.46.43.199
babywow.co.uk.		604124	IN	A	204.46.43.2
babywow.co.uk.		604124	IN	A	204.46.43.20
babywow.co.uk.		604124	IN	A	204.46.43.200
babywow.co.uk.		604124	IN	A	204.46.43.201
babywow.co.uk.		604124	IN	A	204.46.43.202
babywow.co.uk.		604124	IN	A	204.46.43.203
babywow.co.uk.		604124	IN	A	204.46.43.204
babywow.co.uk.		604124	IN	A	204.46.43.205
babywow.co.uk.		604124	IN	A	204.46.43.206
babywow.co.uk.		604124	IN	A	204.46.43.207
babywow.co.uk.		604124	IN	A	204.46.43.208
babywow.co.uk.		604124	IN	A	204.46.43.209
babywow.co.uk.		604124	IN	A	204.46.43.21
babywow.co.uk.		604124	IN	A	204.46.43.210
babywow.co.uk.		604124	IN	A	204.46.43.211
babywow.co.uk.		604124	IN	A	204.46.43.212
babywow.co.uk.		604124	IN	A	204.46.43.213
babywow.co.uk.		604124	IN	A	204.46.43.214
babywow.co.uk.		604124	IN	A	204.46.43.215
babywow.co.uk.		604124	IN	A	204.46.43.216
babywow.co.uk.		604124	IN	A	204.46.43.217
babywow.co.uk.		604124	IN	A	204.46.43.218
babywow.co.uk.		604124	IN	A	204.46.43.219
babywow.co.uk.		604124	IN	A	204.46.43.22
babywow.co.uk.		604124	IN	A	204.46.43.220
babywow.co.uk.		604124	IN	A	204.46.43.221
babywow.co.uk.		604124	IN	A	204.46.43.222
babywow.co.uk.		604124	IN	A	204.46.43.223
babywow.co.uk.		604124	IN	A	204.46.43.224
babywow.co.uk.		604124	IN	A	204.46.43.225
babywow.co.uk.		604124	IN	A	204.46.43.226
babywow.co.uk.		604124	IN	A	204.46.43.227
babywow.co.uk.		604124	IN	A	204.46.43.228
babywow.co.uk.		604124	IN	A	204.46.43.229
babywow.co.uk.		604124	IN	A	204.46.43.23
babywow.co.uk.		604124	IN	A	204.46.43.230
babywow.co.uk.		604124	IN	A	204.46.43.231
babywow.co.uk.		604124	IN	A	204.46.43.232
babywow.co.uk.		604124	IN	A	204.46.43.233
babywow.co.uk.		604124	IN	A	204.46.43.234
babywow.co.uk.		604124	IN	A	204.46.43.235
babywow.co.uk.		604124	IN	A	204.46.43.236
babywow.co.uk.		604124	IN	A	204.46.43.237
babywow.co.uk.		604124	IN	A	204.46.43.238
babywow.co.uk.		604124	IN	A	204.46.43.239
babywow.co.uk.		604124	IN	A	204.46.43.24
babywow.co.uk.		604124	IN	A	204.46.43.240
babywow.co.uk.		604124	IN	A	204.46.43.25
babywow.co.uk.		604124	IN	A	204.46.43.26
babywow.co.uk.		604124	IN	A	204.46.43.27
babywow.co.uk.		604124	IN	A	204.46.43.28
babywow.co.uk.		604124	IN	A	204.46.43.29
babywow.co.uk.		604124	IN	A	204.46.43.3
babywow.co.uk.		604124	IN	A	204.46.43.30
babywow.co.uk.		604124	IN	A	204.46.43.31
babywow.co.uk.		604124	IN	A	204.46.43.32
babywow.co.uk.		604124	IN	A	204.46.43.33
babywow.co.uk.		604124	IN	A	204.46.43.34
babywow.co.uk.		604124	IN	A	204.46.43.35
babywow.co.uk.		604124	IN	A	204.46.43.36
babywow.co.uk.		604124	IN	A	204.46.43.37
babywow.co.uk.		604124	IN	A	204.46.43.38
babywow.co.uk.		604124	IN	A	204.46.43.39
babywow.co.uk.		604124	IN	A	204.46.43.4
babywow.co.uk.		604124	IN	A	204.46.43.40
babywow.co.uk.		604124	IN	A	204.46.43.41
babywow.co.uk.		604124	IN	A	204.46.43.42
babywow.co.uk.		604124	IN	A	204.46.43.43
babywow.co.uk.		604124	IN	A	204.46.43.44
babywow.co.uk.		604124	IN	A	204.46.43.45
babywow.co.uk.		604124	IN	A	204.46.43.46
babywow.co.uk.		604124	IN	A	204.46.43.47
babywow.co.uk.		604124	IN	A	204.46.43.48
babywow.co.uk.		604124	IN	A	204.46.43.49
babywow.co.uk.		604124	IN	A	204.46.43.5
babywow.co.uk.		604124	IN	A	204.46.43.50
babywow.co.uk.		604124	IN	A	204.46.43.51
babywow.co.uk.		604124	IN	A	204.46.43.52
babywow.co.uk.		604124	IN	A	204.46.43.53
babywow.co.uk.		604124	IN	A	204.46.43.54
babywow.co.uk.		604124	IN	A	204.46.43.55
babywow.co.uk.		604124	IN	A	204.46.43.56
babywow.co.uk.		604124	IN	A	204.46.43.57
babywow.co.uk.		604124	IN	A	204.46.43.58
babywow.co.uk.		604124	IN	A	204.46.43.59
babywow.co.uk.		604124	IN	A	204.46.43.6
babywow.co.uk.		604124	IN	A	204.46.43.60
babywow.co.uk.		604124	IN	A	204.46.43.61
babywow.co.uk.		604124	IN	A	204.46.43.62
babywow.co.uk.		604124	IN	A	204.46.43.63
babywow.co.uk.		604124	IN	A	204.46.43.64
babywow.co.uk.		604124	IN	A	204.46.43.65
babywow.co.uk.		604124	IN	A	204.46.43.66
babywow.co.uk.		604124	IN	A	204.46.43.67
babywow.co.uk.		604124	IN	A	204.46.43.68
babywow.co.uk.		604124	IN	A	204.46.43.69
babywow.co.uk.		604124	IN	A	204.46.43.7
babywow.co.uk.		604124	IN	A	204.46.43.70
babywow.co.uk.		604124	IN	A	204.46.43.71
babywow.co.uk.		604124	IN	A	204.46.43.72
babywow.co.uk.		604124	IN	A	204.46.43.73
babywow.co.uk.		604124	IN	A	204.46.43.74
babywow.co.uk.		604124	IN	A	204.46.43.75
babywow.co.uk.		604124	IN	A	204.46.43.76
babywow.co.uk.		604124	IN	A	204.46.43.77
babywow.co.uk.		604124	IN	A	204.46.43.78
babywow.co.uk.		604124	IN	A	204.46.43.79
babywow.co.uk.		604124	IN	A	204.46.43.8
babywow.co.uk.		604124	IN	A	204.46.43.80
babywow.co.uk.		604124	IN	A	204.46.43.81
babywow.co.uk.		604124	IN	A	204.46.43.82
babywow.co.uk.		604124	IN	A	204.46.43.83
babywow.co.uk.		604124	IN	A	204.46.43.84
babywow.co.uk.		604124	IN	A	204.46.43.85
babywow.co.uk.		604124	IN	A	204.46.43.86
babywow.co.uk.		604124	IN	A	204.46.43.87
babywow.co.uk.		604124	IN	A	204.46.43.88
babywow.co.uk.		604124	IN	A	204.46.43.89
babywow.co.uk.		604124	IN	A	204.46.43.9
babywow.co.uk.		604124	IN	A	204.46.43.90
babywow.co.uk.		604124	IN	A	204.46.43.91
babywow.co.uk.		604124	IN	A	204.46.43.92
babywow.co.uk.		604124	IN	A	204.46.43.93
babywow.co.uk.		604124	IN	A	204.46.43.94
babywow.co.uk.		604124	IN	A	204.46.43.95
babywow.co.uk.		604124	IN	A	204.46.43.96
babywow.co.uk.		604124	IN	A	204.46.43.97
babywow.co.uk.		604124	IN	A	204.46.43.98
babywow.co.uk.		604124	IN	A	204.46.43.99
babywow.co.uk.		604124	IN	A	204.46.43.1
babywow.co.uk.		604124	IN	A	204.46.43.10
babywow.co.uk.		604124	IN	A	204.46.43.100
babywow.co.uk.		604124	IN	A	204.46.43.101
babywow.co.uk.		604124	IN	A	204.46.43.102
babywow.co.uk.		604124	IN	A	204.46.43.103
babywow.co.uk.		604124	IN	A	204.46.43.104
babywow.co.uk.		604124	IN	A	204.46.43.105
babywow.co.uk.		604124	IN	A	204.46.43.106
babywow.co.uk.		604124	IN	A	204.46.43.107
babywow.co.uk.		604124	IN	A	204.46.43.108
babywow.co.uk.		604124	IN	A	204.46.43.109
babywow.co.uk.		604124	IN	A	204.46.43.11
babywow.co.uk.		604124	IN	A	204.46.43.110
babywow.co.uk.		604124	IN	A	204.46.43.111
babywow.co.uk.		604124	IN	A	204.46.43.112
babywow.co.uk.		604124	IN	A	204.46.43.113
babywow.co.uk.		604124	IN	A	204.46.43.114
babywow.co.uk.		604124	IN	A	204.46.43.115
babywow.co.uk.		604124	IN	A	204.46.43.116
babywow.co.uk.		604124	IN	A	204.46.43.117
babywow.co.uk.		604124	IN	A	204.46.43.118
babywow.co.uk.		604124	IN	A	204.46.43.119
babywow.co.uk.		604124	IN	A	204.46.43.12
babywow.co.uk.		604124	IN	A	204.46.43.120
babywow.co.uk.		604124	IN	A	204.46.43.121
babywow.co.uk.		604124	IN	A	204.46.43.122
babywow.co.uk.		604124	IN	A	204.46.43.123
babywow.co.uk.		604124	IN	A	204.46.43.124
babywow.co.uk.		604124	IN	A	204.46.43.125
babywow.co.uk.		604124	IN	A	204.46.43.126
babywow.co.uk.		604124	IN	A	204.46.43.127
babywow.co.uk.		604124	IN	A	204.46.43.128
babywow.co.uk.		604124	IN	A	204.46.43.129
babywow.co.uk.		604124	IN	A	204.46.43.13
babywow.co.uk.		604124	IN	A	204.46.43.130
babywow.co.uk.		604124	IN	A	204.46.43.131
babywow.co.uk.		604124	IN	A	204.46.43.132
babywow.co.uk.		604124	IN	A	204.46.43.133
babywow.co.uk.		604124	IN	A	204.46.43.134
babywow.co.uk.		604124	IN	A	204.46.43.135
babywow.co.uk.		604124	IN	A	204.46.43.136
babywow.co.uk.		604124	IN	A	204.46.43.137
babywow.co.uk.		604124	IN	A	204.46.43.138
babywow.co.uk.		604124	IN	A	204.46.43.139
babywow.co.uk.		604124	IN	A	204.46.43.14
babywow.co.uk.		604124	IN	A	204.46.43.140
babywow.co.uk.		604124	IN	A	204.46.43.141
babywow.co.uk.		604124	IN	A	204.46.43.142
babywow.co.uk.		604124	IN	A	204.46.43.143
babywow.co.uk.		604124	IN	A	204.46.43.144
babywow.co.uk.		604124	IN	A	204.46.43.145
babywow.co.uk.		604124	IN	A	204.46.43.146
babywow.co.uk.		604124	IN	A	204.46.43.147
babywow.co.uk.		604124	IN	A	204.46.43.148
babywow.co.uk.		604124	IN	A	204.46.43.149
babywow.co.uk.		604124	IN	A	204.46.43.15
babywow.co.uk.		604124	IN	A	204.46.43.150
babywow.co.uk.		604124	IN	A	204.46.43.151
babywow.co.uk.		604124	IN	A	204.46.43.152
babywow.co.uk.		604124	IN	A	204.46.43.153
babywow.co.uk.		604124	IN	A	204.46.43.154
babywow.co.uk.		604124	IN	A	204.46.43.155
babywow.co.uk.		604124	IN	A	204.46.43.156
babywow.co.uk.		10124	IN	TXT	"OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!2jUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI"
babywow.co.uk.		10124	IN	TXT	"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Oct 12 00:59:11 2013
;; MSG SIZE  rcvd: 4515
$ whois 173.246.97.2

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=173.246.97.2?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       173.246.96.0 - 173.246.111.255
CIDR:           173.246.96.0/20
OriginAS:       AS29169
NetName:        GANDI-NET-DC1-1
NetHandle:      NET-173-246-96-0-1
Parent:         NET-173-0-0-0-0
NetType:        Direct Allocation
Comment:        http://www.gandi.net/
RegDate:        2010-06-18
Updated:        2012-02-24
Ref:            http://whois.arin.net/rest/net/NET-173-246-96-0-1

OrgName:        Gandi US Inc.
OrgId:          GANDI-2
Address:        Gandi US Inc.
Address:        PO Box 32863
City:           Baltimore
StateProv:      MD
PostalCode:     21282
Country:        US
RegDate:        2010-05-20
Updated:        2010-06-24
Comment:        Gandi is an ICANN accredited registrar and VPS/Cloud hosting provider with operations in France, UK, and the United States.
Comment:        http://www.gandi.net/
Ref:            http://whois.arin.net/rest/org/GANDI-2

OrgTechHandle: VANDE4-ARIN
OrgTechName:   Vandervort, Leland 
OrgTechPhone:  +33170393759 
OrgTechEmail:  leland@gandi.net
OrgTechRef:    http://whois.arin.net/rest/poc/VANDE4-ARIN

OrgNOCHandle: GANDI1-ARIN
OrgNOCName:   Gandi NOC
OrgNOCPhone:  +33170393755 
OrgNOCEmail:  noc@gandi.net
OrgNOCRef:    http://whois.arin.net/rest/poc/GANDI1-ARIN

OrgTechHandle: LEADM-ARIN
OrgTechName:   Leadmon, Howard 
OrgTechPhone:  +1-410-515-5843 
OrgTechEmail:  howard@gandi.net
OrgTechRef:    http://whois.arin.net/rest/poc/LEADM-ARIN

OrgAbuseHandle: GAD43-ARIN
OrgAbuseName:   Gandi Abuse Department
OrgAbusePhone:  +33 1 70 39 37 70 
OrgAbuseEmail:  abuse@gandi.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/GAD43-ARIN

RTechHandle: VANDE4-ARIN
RTechName:   Vandervort, Leland 
RTechPhone:  +33170393759 
RTechEmail:  leland@gandi.net
RTechRef:    http://whois.arin.net/rest/poc/VANDE4-ARIN

RNOCHandle: GANDI1-ARIN
RNOCName:   Gandi NOC
RNOCPhone:  +33170393755 
RNOCEmail:  noc@gandi.net
RNOCRef:    http://whois.arin.net/rest/poc/GANDI1-ARIN

RAbuseHandle: GAD43-ARIN
RAbuseName:   Gandi Abuse Department
RAbusePhone:  +33 1 70 39 37 70 
RAbuseEmail:  abuse@gandi.net
RAbuseRef:    http://whois.arin.net/rest/poc/GAD43-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
$ whois 217.70.184.40
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '217.70.184.0 - 217.70.184.255'

% Abuse contact for '217.70.184.0 - 217.70.184.255' is 'abuse@gandi.net'

inetnum:        217.70.184.0 - 217.70.184.255
netname:        GANDIFR-NET4
descr:          GANDI FRANCE L/B SERVICES
country:        FR
admin-c:        LV314-RIPE
admin-c:        PB10691-RIPE
tech-c:         GNO4-RIPE
tech-c:         NG183-RIPE
mnt-by:         GANDI-NOC
mnt-lower:      GANDI-NOC
mnt-routes:     GANDI-NOC
status:         ASSIGNED PA
source:         RIPE # Filtered

role:           Gandi Network Operations
address:        63-65 Boulevard Massena
address:        75013 Paris
address:        France
phone:          +33 1 70 39 37 55
admin-c:        LV314-RIPE
tech-c:         LV314-RIPE
nic-hdl:        GNO4-RIPE
remarks:        Gandi SAS NOC Role
remarks:        Gandi is an ICANN accredited Registrar
remarks:        http://www.gandi.net/
remarks:        - Network Issues:  noc@gandi.net
remarks:        - Abuse/SPAM:  abuse@gandi.net
abuse-mailbox:  abuse@gandi.net
mnt-by:         GANDI-NOC
source:         RIPE # Filtered

role:           NOC Gandi
address:        GANDI
address:        63-65 Boulevard Massena
address:        75013 Paris
admin-c:        LV314-RIPE
tech-c:         LV314-RIPE
nic-hdl:        NG183-RIPE
mnt-by:         GANDI-NOC
remarks:        -------------------------------------------------
remarks:        GANDI is an ICANN accredited registrar
remarks:        for more information:
remarks:        Web:   http://www.gandi.net
remarks:        -------------------------------------------------
remarks:        - network troubles: ipnoc@gandi.net
remarks:        - SPAM complaints: abuse@gandi.net
remarks:        -------------------------------------------------
source:         RIPE # Filtered

person:         Leland Vandervort
address:        Gandi SAS
address:        63-65 Boulevard Massena
address:        75013 Paris
address:        France
phone:          +33 1 70 39 37 55
nic-hdl:        LV314-RIPE
mnt-by:         DISCPRO-MNT
source:         RIPE # Filtered

person:         Pascal Bouchareine
address:        Gandi SAS
address:        63-65 Boulevard Massena
address:        75013 Paris
address:        France
phone:          +33 1 70 39 37 55
nic-hdl:        PB10691-RIPE
mnt-by:         GANDI-NOC
source:         RIPE # Filtered

% Information related to '217.70.176.0/20AS29169'

route:          217.70.176.0/20
descr:          GANDI is an ICANN accredited registrar
descr:          for more information:
descr:          Web:   http://www.gandi.net
origin:         AS29169
mnt-by:         GANDI-NOC
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.69 (WHOIS1)

DNSアンプ攻撃観測 (ietf.org)

説明はいらないIETFのドメイン.DNSSECで膨れ上がるのは避けられないのか・・・

$ dig @::1 ietf.org any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.6-P1 <<>> @::1 ietf.org any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15216
;; flags: qr rd ra; QUERY: 1, ANSWER: 25, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;ietf.org.			IN	ANY

;; ANSWER SECTION:
ietf.org.		1800	IN	SOA	ns0.ietf.org. glen.amsl.com. 1200000189 1800 1800 604800 1800
ietf.org.		1800	IN	RRSIG	SOA 5 2 1800 20141005142200 20131005132312 40452 ietf.org. qZtJJUCC8g/u3UtZ6ce/6XJZZBFc8Py1XUxsUQjE+FYEtM/ZphLqx491 uJiqPnw1zH8xiCeSPhnSSYHWYAQuuB+S3/Xf41JmXE3TvWv36LTmGC8Z JpIGsB9twizqbuH1K3KJxEAfUeGrFjill8PhL3FNO+33yDbxmBSxNePc kh9V2GZlUBk1Y2nIzEgRPzPArkjzKo/gsVqXf3QhfAeo+nr/Wslu2rQJ yAwxn+/lupR+43Tsp15AOE/iJfVGKXBKWgHQQeShFmEHY7s7CtgCyWAz kBkmF3Bwhw6IfGMZaBBFEL5y33nftJuCS4q3j0ibwl0xFoLniGqcm6MX V2RKsQ==
ietf.org.		1800	IN	NS	ns1.ams1.afilias-nst.info.
ietf.org.		1800	IN	NS	ns1.sea1.afilias-nst.info.
ietf.org.		1800	IN	NS	ns1.mia1.afilias-nst.info.
ietf.org.		1800	IN	NS	ns0.amsl.com.
ietf.org.		1800	IN	NS	ns1.hkg1.afilias-nst.info.
ietf.org.		1800	IN	NS	ns1.yyz1.afilias-nst.info.
ietf.org.		1800	IN	RRSIG	NS 5 2 1800 20141005142154 20131005132312 40452 ietf.org. jzt9WP7ciMq7pIAz31vQX/qr8RM8ZDQrTC9HK6YEwa96cGY3IbGr91KT IjpPnyb/T605rAk8DfGKX9CrJOKeGA3JekG6eBWs2bwGWZbLgoUwtfI4 sePkPsneFQk+WR0dl/K5lHTU/a9DodsYQhY98dMHSDK0nYctSScrCURP 0V9+4aG9k28HA5oZzC3LtQY63uzleieh+am1sPqX0HtHnUEvIEJ3FtzB y+po+lye/Fmj7CJXE+CDvwhtXRYbVhi/oQqQMQF6+QKCGAE2/p2yMd8U Zcu0uL3NkiiChINLfwIxB9K4vZQyqneX/OX1Tv8tVSEDb7br0hKV7Cpd wAMQ9w==
ietf.org.		1800	IN	A	12.22.58.30
ietf.org.		1800	IN	RRSIG	A 5 2 1800 20141005142303 20131005132312 40452 ietf.org. j8/lX7JcNljhbKDPihih2Mil1uOBhpwX7zghqhkdDC2nYVZp4q+INucf YkmCCsKCOjaUaUogm+1B9IWewFln+YA4DGvSxCXQj8ugtl8kFauxtlMK 24KQH4g15SwhDEKmkNygQB2r6PjDXtwwODxFKQsL7Gnyvpb638IaQ5UI LHye4JikzEstmQ9kOuUz71CV/nU/aDkem2U8pMykxyudTSL6uq6YyBN5 GH8GzZNrMyDCmUxKxbLAq+QbH2XFf/s75Zp38JnTuMEUP+NvBcaWl/5e f1W9veXIrxC+/XugE0rA+oWvgKwocULJNpgM4BnqFZ0TplevpM2hxxYM x9naPA==
ietf.org.		1800	IN	MX	0 mail.ietf.org.
ietf.org.		1800	IN	RRSIG	MX 5 2 1800 20141005142036 20131005132312 40452 ietf.org. oD7YBiYO+SEa09TNK1Qveq9lz4tJmvKv5W4wdnZU+cNXQTwODOFga2ra 7pqdY4eJz1almmUAR3Q2bugtFhOXBAA89D71NoawLhVnW6kLI38YOyXx //bpVLNN0Wz9CxA/T2PigWbwRwloe9I1lbhAuEL+7z8IYxZSgTk9bMSO VKynBYRloJ/gfSCi+GVjsqQKecT6h/NwfJJqVC9VuTTonLAeD/K5sWTT up5oOCdC9QYdruLq8dWYpAf44Lvj40ZTKtCjnggc5yFYCPupuDE7ENad iIAZxuqzshxXrcpklB0Eeifbd9ofVd8eTt+PNvCnJhlcK2AOjvBh+aKt YEYw/A==
ietf.org.		1800	IN	TXT	"v=spf1 ip4:12.22.58.0/26 ip4:64.170.98.0/26 ip4:209.208.19.192/27 ip6:2607:f170:8000:1500::0/64 ip6:2001:1890:123a::0/56 ip6:2001:1890:126c::0/56 -all"
ietf.org.		1800	IN	RRSIG	TXT 5 2 1800 20141005142022 20131005132312 40452 ietf.org. ISIZrTOa4Uz7KDL1KO7V53lXIp4KECyTA7pEgqj4M8O991e+ykSpx4oQ JZ1B16zgMUKWPMrHnP5G3A9VKAmYp43lPnapQTyGNhd/l2z4SxU2Rmjr EYOI0SrRCTT6FNw8XBnDENRqr749kECQLPOjOGfrHwrepG78rORShxVa HhzHxaouyv7qE8Gx6MYPXFt92AnPj0IkljbMQiomqTgTvRdVX9Cdwp34 nQcjLK/550SleqM21hXTVhd46R9OT2/w/Q4n/6FTSRyGo0v3FOyC2E6B iDPr/rOnI7YaNO4c+bR5gAQ4T0Lrr0OEGRp/A9l6xaInGa31cGQH0gbZ ZzIKGg==
ietf.org.		1800	IN	AAAA	2001:1890:123a::1:1e
ietf.org.		1800	IN	RRSIG	AAAA 5 2 1800 20141005142143 20131005132312 40452 ietf.org. iZFEbjZP/ZemUxlSUr0gt6CySYaUypIUQYWkYRRexeyC4G3Snfyi21cW ErYitL/auUfVWbEujbFavBQ+fEtbtwzwQt0k2frT6Vzd8N5J3sgwmZ8a LWDMdJnEoFCn3JC+hVBxrKKfgR8JYZx0VCUavCliMCjGDn917Kwe+hQk 4S3CRmlRLi4Hum7yZPv1ukXHqErCiPpnaq4k9eXElXhX9z3hkpRCkzzg zjaM9FplG3wIH0knyytvLkytQEU8I5DIX7yHVzR10Z3fvIO3ibZKoVXx oxPfsG8SEhcVpAstTn0VvSqpcSJd35BdV1idUkVUCpcYq+tjL19s2oXR ccfUmw==
ietf.org.		1800	IN	NSEC	ietf1._domainkey.ietf.org. A NS SOA MX TXT AAAA RRSIG NSEC DNSKEY SPF
ietf.org.		1800	IN	RRSIG	NSEC 5 2 1800 20141005142148 20131005132312 40452 ietf.org. ng9FVyGwVtbYp7nSpSTELROWYdzQ20KbM3Jju2UA2X1tq97RCJf3ZIZI YRCBbHYzd22UYtnc/K+s4FYyjLrdzr61lHDSTvwpJgMue9sYIyIunYNk z8sOz93FKmURSDdpQeCUvXiv50+1XYJQ+mnyIsdFlAUGzT1eZ6ktWgKW YS1qtJMBY3pcpqxGu44ushjNPmq6eGyCXP1bvFOetIFMIRORPso+zR5E m6JrFSgf5fR2mUuOD7SHit1kRjoofnXcEFeyx1YRerfZPCHRwN2yab4P jf7sScC9ODyt9Q+Eo4y7gMJDNYkKC932voaa/ZSyq3HqzhHhCWH0FdYr KExHhQ==
ietf.org.		1800	IN	DNSKEY	257 3 5 AwEAAavjQ1H6pE8FV8LGP0wQBFVL0EM9BRfqxz9p/sZ+8AByqyFHLdZc HoOGF7CgB5OKYMvGOgysuYQloPlwbq7Ws5WywbutbXyG24lMWy4jijlJ UsaFrS5EvUu4ydmuRc/TGnEXnN1XQkO+waIT4cLtrmcWjoY8Oqud6lDa Jdj1cKr2nX1NrmMRowIu3DIVtGbQJmzpukpDVZaYMMAm8M5vz4U2vRCV ETLgDoQ7rhsiD127J8gVExjO8B0113jCajbFRcMtUtFTjH4z7jXP2ZzD cXsgpe4LYFuenFQAcRBRlE6oaykHR7rlPqqmw58nIELJUFoMcb/BdRLg byTeurFlnxs=
ietf.org.		1800	IN	DNSKEY	256 3 5 AwEAAdDECajHaTjfSoNTY58WcBah1BxPKVIHBz4IfLjfqMvium4lgKtK ZLe97DgJ5/NQrNEGGQmr6fKvUj67cfrZUojZ2cGRizVhgkOqZ9scaTVX NuXLM5Tw7VWOVIceeXAuuH2mPIiEV6MhJYUsW6dvmNsJ4XwCgNgroAmX hoMEiWEjBB+wjYZQ5GtZHBFKVXACSWTiCtddHcueOeSVPi5WH94Vlubh HfiytNPZLrObhUCHT6k0tNE6phLoHnXWU+6vpsYpz6GhMw/R9BFxW5Pd PFIWBgoWk2/XFVRSKG9Lr61b2z1R126xeUwvw46RVy3hanV3vNO7LM5H niqaYclBbhk=
ietf.org.		1800	IN	RRSIG	DNSKEY 5 2 1800 20141005142233 20131005132312 40452 ietf.org. ycOZ3CwYOirGr8pVSoliTguY0/H48cQvqu5TQ7dfTdS2zv6BCtyGAsPz yJBggqJFOiuth4ju2C1J8mA+1bYov3Keo2G3YvaHz1i2LDWp2ZUH1UWn hIpbbevKTQ7vvY3P3QXW0z86uaiy82Ki3/BD2AZw5/+a2U88hSBGAUnd LSZtnGyBFwwvQojM5d0OGuTzii4uopmXb3gKfDL0/8SPGt0b9H2FRvak tM3XlcaPbj93ZL217RhNnE+cznBDfWkEZFMiOTCMj7thfnYZ91W60AD9 fMIXpQ3GM6NWDboomHTTJxObv9j8uYl1pdVDnGCEKJ7IFhpm/CsvzRjZ 9fGSkg==
ietf.org.		1800	IN	RRSIG	DNSKEY 5 2 1800 20141005142239 20131005132312 45586 ietf.org. CNa7Tr6S0bO3lin4AChKWkfUmExogYNwRucMyotgcgMtgzSeG9p7IFib YHH41aPMq9q9jPU4KzAoH6H62DlnbSxcv7MqYbIN+gQXKkXOIxw8qu0M vUpaPZTAupmcZEk3evQj2xusYTd/j7UKA++C/7xWznaeZKXQMxpqcJU8 6sKrmQtMGmwSpy1FqaSxuPrP8QdEf4EF2PAJubQLnS+O8o5s6CsefFKy f3z3aPfUctjkbGOcNAS7shogwcE9ftIbnRdk+Idsnopy+5uYbNgQ9p1N NgIUXqEg4XLdyA6jCefisntUEXwEyccKT7yoJnBjq5pnRWheVGWrPlIk ATG6IQ==
ietf.org.		1800	IN	SPF	"v=spf1 ip4:12.22.58.0/26 ip4:64.170.98.0/26 ip4:209.208.19.192/27 ip6:2607:f170:8000:1500::0/64 ip6:2001:1890:123a::0/56 ip6:2001:1890:126c::0/56 -all"
ietf.org.		1800	IN	RRSIG	SPF 5 2 1800 20141005142242 20131005132312 40452 ietf.org. exnxgXoyzhNRgw+HO/c7xqjLVr7Rv2/eL4nkwah815MlR7WEtXPiyBhs SYorGyuKGPzG781BriBf7tjz0sxjy4eDYJlPPlGhaGJXZiGpW14gMEoO 8Td9BL4k6zAOyMTsHCcCzwfMYaIx1xCu8FyMjk+TPmUHLVfJyyydcSa4 j5cZJNRcZKZwQGoo+YWrPzT0N0HLuvhNFe/fs4p0QoMmggdWcbMuEfRB rK+XIBwt8lmvuRqwfR51Cc9a67Hd0ZYisq7d8nctQSmHZNZMGDuU3DvT nfC2mXi6DmgvCxCiTjQGXV9etb0yc75x+Jep+9Gs/sLzIOYzB6xYCKx/ m5yZdA==

;; ADDITIONAL SECTION:
mail.ietf.org.		1800	IN	A	12.22.58.30
mail.ietf.org.		1800	IN	AAAA	2001:1890:123a::1:1e

;; Query time: 4 msec
;; SERVER: ::1#53(::1)
;; WHEN: Fri Oct 11 12:21:55 2013
;; MSG SIZE  rcvd: 4229

2013-10-09

DNSアンプ攻撃観測 (30259.info)

NSと地図はaa.10781.infoと同じ.

$ dig 30259.info any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.1-P1 <<>> 30259.info any
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13466
;; flags: qr rd ra; QUERY: 1, ANSWER: 259, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;30259.info.			IN	ANY

;; ANSWER SECTION:
30259.info.		4794	IN	A	201.183.121.171
30259.info.		4794	IN	A	201.183.121.172
30259.info.		4794	IN	A	201.183.121.173
30259.info.		4794	IN	A	201.183.121.174
30259.info.		4794	IN	A	201.183.121.175
30259.info.		4794	IN	A	201.183.121.176
30259.info.		4794	IN	A	201.183.121.177
30259.info.		4794	IN	A	201.183.121.178
30259.info.		4794	IN	A	201.183.121.179
30259.info.		4794	IN	A	201.183.121.180
30259.info.		4794	IN	A	201.183.121.181
30259.info.		4794	IN	A	201.183.121.182
30259.info.		4794	IN	A	201.183.121.183
30259.info.		4794	IN	A	201.183.121.184
30259.info.		4794	IN	A	201.183.121.185
30259.info.		4794	IN	A	201.183.121.186
30259.info.		4794	IN	A	201.183.121.187
30259.info.		4794	IN	A	201.183.121.188
30259.info.		4794	IN	A	201.183.121.189
30259.info.		4794	IN	A	201.183.121.190
30259.info.		4794	IN	A	201.183.121.191
30259.info.		4794	IN	A	201.183.121.192
30259.info.		4794	IN	A	201.183.121.193
30259.info.		4794	IN	A	201.183.121.194
30259.info.		4794	IN	A	201.183.121.195
30259.info.		4794	IN	A	201.183.121.196
30259.info.		4794	IN	A	201.183.121.197
30259.info.		4794	IN	A	201.183.121.198
30259.info.		4794	IN	A	201.183.121.199
30259.info.		4794	IN	A	201.183.121.200
30259.info.		4794	IN	A	201.183.121.201
30259.info.		4794	IN	A	201.183.121.202
30259.info.		4794	IN	A	201.183.121.203
30259.info.		4794	IN	A	201.183.121.204
30259.info.		4794	IN	A	201.183.121.205
30259.info.		4794	IN	A	201.183.121.206
30259.info.		4794	IN	A	201.183.121.207
30259.info.		4794	IN	A	201.183.121.208
30259.info.		4794	IN	A	201.183.121.209
30259.info.		4794	IN	A	201.183.121.210
30259.info.		4794	IN	A	201.183.121.211
30259.info.		4794	IN	A	201.183.121.212
30259.info.		4794	IN	A	201.183.121.213
30259.info.		4794	IN	A	201.183.121.214
30259.info.		4794	IN	A	201.183.121.215
30259.info.		4794	IN	A	201.183.121.216
30259.info.		4794	IN	A	201.183.121.217
30259.info.		4794	IN	A	201.183.121.218
30259.info.		4794	IN	A	201.183.121.219
30259.info.		4794	IN	A	201.183.121.220
30259.info.		4794	IN	A	201.183.121.221
30259.info.		4794	IN	A	201.183.121.222
30259.info.		4794	IN	A	201.183.121.223
30259.info.		4794	IN	A	201.183.121.224
30259.info.		4794	IN	A	201.183.121.225
30259.info.		4794	IN	A	201.183.121.226
30259.info.		4794	IN	A	201.183.121.227
30259.info.		4794	IN	A	201.183.121.228
30259.info.		4794	IN	A	201.183.121.229
30259.info.		4794	IN	A	201.183.121.230
30259.info.		4794	IN	A	201.183.121.231
30259.info.		4794	IN	A	201.183.121.232
30259.info.		4794	IN	A	201.183.121.233
30259.info.		4794	IN	A	201.183.121.234
30259.info.		4794	IN	A	201.183.121.235
30259.info.		4794	IN	A	201.183.121.236
30259.info.		4794	IN	A	201.183.121.237
30259.info.		4794	IN	A	201.183.121.238
30259.info.		4794	IN	A	201.183.121.239
30259.info.		4794	IN	A	201.183.121.240
30259.info.		4794	IN	A	201.183.121.241
30259.info.		4794	IN	A	201.183.121.242
30259.info.		4794	IN	A	201.183.121.243
30259.info.		4794	IN	A	201.183.121.244
30259.info.		4794	IN	A	201.183.121.245
30259.info.		4794	IN	A	201.183.121.246
30259.info.		4794	IN	A	201.183.121.247
30259.info.		4794	IN	A	201.183.121.248
30259.info.		4794	IN	A	201.183.121.249
30259.info.		4794	IN	A	201.183.121.250
30259.info.		4794	IN	A	201.183.121.251
30259.info.		4794	IN	A	201.183.121.252
30259.info.		4794	IN	A	201.183.121.253
30259.info.		4794	IN	A	201.183.121.254
30259.info.		4794	IN	A	201.183.120.100
30259.info.		4794	IN	A	201.183.120.101
30259.info.		4794	IN	A	201.183.120.102
30259.info.		4794	IN	A	201.183.120.103
30259.info.		4794	IN	A	201.183.120.104
30259.info.		4794	IN	A	201.183.120.105
30259.info.		4794	IN	A	201.183.120.106
30259.info.		4794	IN	A	201.183.120.107
30259.info.		4794	IN	A	201.183.120.108
30259.info.		4794	IN	A	201.183.120.109
30259.info.		4794	IN	A	201.183.120.110
30259.info.		4794	IN	A	201.183.120.111
30259.info.		4794	IN	A	201.183.120.112
30259.info.		4794	IN	A	201.183.120.113
30259.info.		4794	IN	A	201.183.120.114
30259.info.		4794	IN	A	201.183.120.115
30259.info.		4794	IN	A	201.183.120.116
30259.info.		4794	IN	A	201.183.120.117
30259.info.		4794	IN	A	201.183.120.118
30259.info.		4794	IN	A	201.183.120.119
30259.info.		4794	IN	A	201.183.120.120
30259.info.		4794	IN	A	201.183.120.121
30259.info.		4794	IN	A	201.183.120.122
30259.info.		4794	IN	A	201.183.120.123
30259.info.		4794	IN	A	201.183.120.124
30259.info.		4794	IN	A	201.183.120.125
30259.info.		4794	IN	A	201.183.120.126
30259.info.		4794	IN	A	201.183.120.127
30259.info.		4794	IN	A	201.183.120.128
30259.info.		4794	IN	A	201.183.120.129
30259.info.		4794	IN	A	201.183.120.130
30259.info.		4794	IN	A	201.183.120.131
30259.info.		4794	IN	A	201.183.120.132
30259.info.		4794	IN	A	201.183.120.133
30259.info.		4794	IN	A	201.183.120.134
30259.info.		4794	IN	A	201.183.120.135
30259.info.		4794	IN	A	201.183.120.136
30259.info.		4794	IN	A	201.183.120.137
30259.info.		4794	IN	A	201.183.120.138
30259.info.		4794	IN	A	201.183.120.139
30259.info.		4794	IN	A	201.183.120.140
30259.info.		4794	IN	A	201.183.120.141
30259.info.		4794	IN	A	201.183.120.142
30259.info.		4794	IN	A	201.183.120.143
30259.info.		4794	IN	A	201.183.120.144
30259.info.		4794	IN	A	201.183.120.145
30259.info.		4794	IN	A	201.183.120.146
30259.info.		4794	IN	A	201.183.120.147
30259.info.		4794	IN	A	201.183.120.148
30259.info.		4794	IN	A	201.183.120.149
30259.info.		4794	IN	A	201.183.120.150
30259.info.		4794	IN	A	201.183.120.151
30259.info.		4794	IN	A	201.183.120.152
30259.info.		4794	IN	A	201.183.120.153
30259.info.		4794	IN	A	201.183.120.154
30259.info.		4794	IN	A	201.183.120.155
30259.info.		4794	IN	A	201.183.120.156
30259.info.		4794	IN	A	201.183.120.157
30259.info.		4794	IN	A	201.183.120.158
30259.info.		4794	IN	A	201.183.120.159
30259.info.		4794	IN	A	201.183.120.160
30259.info.		4794	IN	A	201.183.120.161
30259.info.		4794	IN	A	201.183.120.162
30259.info.		4794	IN	A	201.183.120.163
30259.info.		4794	IN	A	201.183.120.164
30259.info.		4794	IN	A	201.183.120.165
30259.info.		4794	IN	A	201.183.120.166
30259.info.		4794	IN	A	201.183.120.167
30259.info.		4794	IN	A	201.183.120.168
30259.info.		4794	IN	A	201.183.120.169
30259.info.		4794	IN	A	201.183.120.170
30259.info.		4794	IN	A	201.183.120.171
30259.info.		4794	IN	A	201.183.120.172
30259.info.		4794	IN	A	201.183.120.173
30259.info.		4794	IN	A	201.183.120.174
30259.info.		4794	IN	A	201.183.120.175
30259.info.		4794	IN	A	201.183.120.176
30259.info.		4794	IN	A	201.183.120.177
30259.info.		4794	IN	A	201.183.120.178
30259.info.		4794	IN	A	201.183.120.179
30259.info.		4794	IN	A	201.183.120.180
30259.info.		4794	IN	A	201.183.120.181
30259.info.		4794	IN	A	201.183.120.182
30259.info.		4794	IN	A	201.183.120.183
30259.info.		4794	IN	A	201.183.120.184
30259.info.		4794	IN	A	201.183.120.185
30259.info.		4794	IN	A	201.183.120.186
30259.info.		4794	IN	A	201.183.120.187
30259.info.		4794	IN	A	201.183.120.188
30259.info.		4794	IN	A	201.183.120.189
30259.info.		4794	IN	A	201.183.120.190
30259.info.		4794	IN	A	201.183.120.191
30259.info.		4794	IN	A	201.183.120.192
30259.info.		4794	IN	A	201.183.120.193
30259.info.		4794	IN	A	201.183.120.194
30259.info.		4794	IN	A	201.183.120.195
30259.info.		4794	IN	A	201.183.120.196
30259.info.		4794	IN	A	201.183.120.197
30259.info.		4794	IN	A	201.183.120.198
30259.info.		4794	IN	A	201.183.120.199
30259.info.		4794	IN	A	201.183.120.200
30259.info.		4794	IN	A	201.183.121.100
30259.info.		4794	IN	A	201.183.121.101
30259.info.		4794	IN	A	201.183.121.102
30259.info.		4794	IN	A	201.183.121.103
30259.info.		4794	IN	A	201.183.121.104
30259.info.		4794	IN	A	201.183.121.105
30259.info.		4794	IN	A	201.183.121.106
30259.info.		4794	IN	A	201.183.121.107
30259.info.		4794	IN	A	201.183.121.108
30259.info.		4794	IN	A	201.183.121.109
30259.info.		4794	IN	A	201.183.121.110
30259.info.		4794	IN	A	201.183.121.111
30259.info.		4794	IN	A	201.183.121.112
30259.info.		4794	IN	A	201.183.121.113
30259.info.		4794	IN	A	201.183.121.114
30259.info.		4794	IN	A	201.183.121.115
30259.info.		4794	IN	A	201.183.121.116
30259.info.		4794	IN	A	201.183.121.117
30259.info.		4794	IN	A	201.183.121.118
30259.info.		4794	IN	A	201.183.121.119
30259.info.		4794	IN	A	201.183.121.120
30259.info.		4794	IN	A	201.183.121.121
30259.info.		4794	IN	A	201.183.121.122
30259.info.		4794	IN	A	201.183.121.123
30259.info.		4794	IN	A	201.183.121.124
30259.info.		4794	IN	A	201.183.121.125
30259.info.		4794	IN	A	201.183.121.126
30259.info.		4794	IN	A	201.183.121.127
30259.info.		4794	IN	A	201.183.121.128
30259.info.		4794	IN	A	201.183.121.129
30259.info.		4794	IN	A	201.183.121.130
30259.info.		4794	IN	A	201.183.121.131
30259.info.		4794	IN	A	201.183.121.132
30259.info.		4794	IN	A	201.183.121.133
30259.info.		4794	IN	A	201.183.121.134
30259.info.		4794	IN	A	201.183.121.135
30259.info.		4794	IN	A	201.183.121.136
30259.info.		4794	IN	A	201.183.121.137
30259.info.		4794	IN	A	201.183.121.138
30259.info.		4794	IN	A	201.183.121.139
30259.info.		4794	IN	A	201.183.121.140
30259.info.		4794	IN	A	201.183.121.141
30259.info.		4794	IN	A	201.183.121.142
30259.info.		4794	IN	A	201.183.121.143
30259.info.		4794	IN	A	201.183.121.144
30259.info.		4794	IN	A	201.183.121.145
30259.info.		4794	IN	A	201.183.121.146
30259.info.		4794	IN	A	201.183.121.147
30259.info.		4794	IN	A	201.183.121.148
30259.info.		4794	IN	A	201.183.121.149
30259.info.		4794	IN	A	201.183.121.150
30259.info.		4794	IN	A	201.183.121.151
30259.info.		4794	IN	A	201.183.121.152
30259.info.		4794	IN	A	201.183.121.153
30259.info.		4794	IN	A	201.183.121.154
30259.info.		4794	IN	A	201.183.121.155
30259.info.		4794	IN	A	201.183.121.156
30259.info.		4794	IN	A	201.183.121.157
30259.info.		4794	IN	A	201.183.121.158
30259.info.		4794	IN	A	201.183.121.159
30259.info.		4794	IN	A	201.183.121.160
30259.info.		4794	IN	A	201.183.121.161
30259.info.		4794	IN	A	201.183.121.162
30259.info.		4794	IN	A	201.183.121.163
30259.info.		4794	IN	A	201.183.121.164
30259.info.		4794	IN	A	201.183.121.165
30259.info.		4794	IN	A	201.183.121.166
30259.info.		4794	IN	A	201.183.121.167
30259.info.		4794	IN	A	201.183.121.168
30259.info.		4794	IN	A	201.183.121.169
30259.info.		4794	IN	A	201.183.121.170
30259.info.		5994	IN	SOA	ns1.05930.info. root.ns1.30259.info. 20091027 28800 600 604800 86400
30259.info.		5994	IN	NS	ns1.05930.info.
30259.info.		5994	IN	NS	ns2.05930.info.

;; Query time: 8 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Oct 10 00:17:47 2013
;; MSG SIZE  rcvd: 4211

DNSアンプ攻撃観測 (aa.10781.info)

$ dig aa.10781.info any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.8.1-P1 <<>> aa.10781.info any
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32011
;; flags: qr rd ra; QUERY: 1, ANSWER: 256, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;aa.10781.info.			IN	ANY

;; ANSWER SECTION:
aa.10781.info.		600	IN	A	161.141.181.250
aa.10781.info.		600	IN	A	161.141.181.251
aa.10781.info.		600	IN	A	161.141.181.252
aa.10781.info.		600	IN	A	161.141.181.253
aa.10781.info.		600	IN	A	161.141.181.254
aa.10781.info.		600	IN	A	161.141.182.100
aa.10781.info.		600	IN	A	161.141.182.101
aa.10781.info.		600	IN	A	161.141.182.102
aa.10781.info.		600	IN	A	161.141.182.103
aa.10781.info.		600	IN	A	161.141.182.104
aa.10781.info.		600	IN	A	161.141.182.105
aa.10781.info.		600	IN	A	161.141.182.106
aa.10781.info.		600	IN	A	161.141.182.107
aa.10781.info.		600	IN	A	161.141.182.108
aa.10781.info.		600	IN	A	161.141.182.109
aa.10781.info.		600	IN	A	161.141.182.110
aa.10781.info.		600	IN	A	161.141.182.111
aa.10781.info.		600	IN	A	161.141.182.112
aa.10781.info.		600	IN	A	161.141.182.113
aa.10781.info.		600	IN	A	161.141.182.114
aa.10781.info.		600	IN	A	161.141.182.115
aa.10781.info.		600	IN	A	161.141.182.116
aa.10781.info.		600	IN	A	161.141.182.117
aa.10781.info.		600	IN	A	161.141.182.118
aa.10781.info.		600	IN	A	161.141.182.119
aa.10781.info.		600	IN	A	161.141.182.120
aa.10781.info.		600	IN	A	161.141.182.121
aa.10781.info.		600	IN	A	161.141.182.122
aa.10781.info.		600	IN	A	161.141.182.123
aa.10781.info.		600	IN	A	161.141.182.124
aa.10781.info.		600	IN	A	161.141.182.125
aa.10781.info.		600	IN	A	161.141.182.126
aa.10781.info.		600	IN	A	161.141.182.127
aa.10781.info.		600	IN	A	161.141.182.128
aa.10781.info.		600	IN	A	161.141.182.129
aa.10781.info.		600	IN	A	161.141.182.130
aa.10781.info.		600	IN	A	161.141.182.131
aa.10781.info.		600	IN	A	161.141.182.132
aa.10781.info.		600	IN	A	161.141.182.133
aa.10781.info.		600	IN	A	161.141.182.134
aa.10781.info.		600	IN	A	161.141.182.135
aa.10781.info.		600	IN	A	161.141.182.136
aa.10781.info.		600	IN	A	161.141.182.137
aa.10781.info.		600	IN	A	161.141.182.138
aa.10781.info.		600	IN	A	161.141.182.139
aa.10781.info.		600	IN	A	161.141.182.140
aa.10781.info.		600	IN	A	161.141.182.141
aa.10781.info.		600	IN	A	161.141.182.142
aa.10781.info.		600	IN	A	161.141.182.143
aa.10781.info.		600	IN	A	161.141.182.144
aa.10781.info.		600	IN	A	161.141.182.145
aa.10781.info.		600	IN	A	161.141.182.146
aa.10781.info.		600	IN	A	161.141.182.147
aa.10781.info.		600	IN	A	161.141.182.148
aa.10781.info.		600	IN	A	161.141.182.149
aa.10781.info.		600	IN	A	161.141.182.150
aa.10781.info.		600	IN	A	161.141.182.151
aa.10781.info.		600	IN	A	161.141.182.152
aa.10781.info.		600	IN	A	161.141.182.153
aa.10781.info.		600	IN	A	161.141.182.154
aa.10781.info.		600	IN	A	161.141.182.155
aa.10781.info.		600	IN	A	161.141.182.156
aa.10781.info.		600	IN	A	161.141.182.157
aa.10781.info.		600	IN	A	161.141.182.158
aa.10781.info.		600	IN	A	161.141.182.159
aa.10781.info.		600	IN	A	161.141.182.160
aa.10781.info.		600	IN	A	161.141.182.161
aa.10781.info.		600	IN	A	161.141.182.162
aa.10781.info.		600	IN	A	161.141.182.163
aa.10781.info.		600	IN	A	161.141.182.164
aa.10781.info.		600	IN	A	161.141.182.165
aa.10781.info.		600	IN	A	161.141.182.166
aa.10781.info.		600	IN	A	161.141.182.167
aa.10781.info.		600	IN	A	161.141.182.168
aa.10781.info.		600	IN	A	161.141.182.169
aa.10781.info.		600	IN	A	161.141.182.170
aa.10781.info.		600	IN	A	161.141.182.171
aa.10781.info.		600	IN	A	161.141.182.172
aa.10781.info.		600	IN	A	161.141.182.173
aa.10781.info.		600	IN	A	161.141.182.174
aa.10781.info.		600	IN	A	161.141.182.175
aa.10781.info.		600	IN	A	161.141.182.176
aa.10781.info.		600	IN	A	161.141.182.177
aa.10781.info.		600	IN	A	161.141.182.178
aa.10781.info.		600	IN	A	161.141.182.179
aa.10781.info.		600	IN	A	161.141.182.180
aa.10781.info.		600	IN	A	161.141.182.181
aa.10781.info.		600	IN	A	161.141.182.182
aa.10781.info.		600	IN	A	161.141.182.183
aa.10781.info.		600	IN	A	161.141.182.184
aa.10781.info.		600	IN	A	161.141.182.185
aa.10781.info.		600	IN	A	161.141.182.186
aa.10781.info.		600	IN	A	161.141.182.187
aa.10781.info.		600	IN	A	161.141.182.188
aa.10781.info.		600	IN	A	161.141.182.189
aa.10781.info.		600	IN	A	161.141.182.190
aa.10781.info.		600	IN	A	161.141.182.191
aa.10781.info.		600	IN	A	161.141.182.192
aa.10781.info.		600	IN	A	161.141.182.193
aa.10781.info.		600	IN	A	161.141.182.194
aa.10781.info.		600	IN	A	161.141.182.195
aa.10781.info.		600	IN	A	161.141.182.196
aa.10781.info.		600	IN	A	161.141.182.197
aa.10781.info.		600	IN	A	161.141.182.198
aa.10781.info.		600	IN	A	161.141.182.199
aa.10781.info.		600	IN	A	161.141.182.200
aa.10781.info.		600	IN	A	161.141.181.100
aa.10781.info.		600	IN	A	161.141.181.101
aa.10781.info.		600	IN	A	161.141.181.102
aa.10781.info.		600	IN	A	161.141.181.103
aa.10781.info.		600	IN	A	161.141.181.104
aa.10781.info.		600	IN	A	161.141.181.105
aa.10781.info.		600	IN	A	161.141.181.106
aa.10781.info.		600	IN	A	161.141.181.107
aa.10781.info.		600	IN	A	161.141.181.108
aa.10781.info.		600	IN	A	161.141.181.109
aa.10781.info.		600	IN	A	161.141.181.110
aa.10781.info.		600	IN	A	161.141.181.111
aa.10781.info.		600	IN	A	161.141.181.112
aa.10781.info.		600	IN	A	161.141.181.113
aa.10781.info.		600	IN	A	161.141.181.114
aa.10781.info.		600	IN	A	161.141.181.115
aa.10781.info.		600	IN	A	161.141.181.116
aa.10781.info.		600	IN	A	161.141.181.117
aa.10781.info.		600	IN	A	161.141.181.118
aa.10781.info.		600	IN	A	161.141.181.119
aa.10781.info.		600	IN	A	161.141.181.120
aa.10781.info.		600	IN	A	161.141.181.121
aa.10781.info.		600	IN	A	161.141.181.122
aa.10781.info.		600	IN	A	161.141.181.123
aa.10781.info.		600	IN	A	161.141.181.124
aa.10781.info.		600	IN	A	161.141.181.125
aa.10781.info.		600	IN	A	161.141.181.126
aa.10781.info.		600	IN	A	161.141.181.127
aa.10781.info.		600	IN	A	161.141.181.128
aa.10781.info.		600	IN	A	161.141.181.129
aa.10781.info.		600	IN	A	161.141.181.130
aa.10781.info.		600	IN	A	161.141.181.131
aa.10781.info.		600	IN	A	161.141.181.132
aa.10781.info.		600	IN	A	161.141.181.133
aa.10781.info.		600	IN	A	161.141.181.134
aa.10781.info.		600	IN	A	161.141.181.135
aa.10781.info.		600	IN	A	161.141.181.136
aa.10781.info.		600	IN	A	161.141.181.137
aa.10781.info.		600	IN	A	161.141.181.138
aa.10781.info.		600	IN	A	161.141.181.139
aa.10781.info.		600	IN	A	161.141.181.140
aa.10781.info.		600	IN	A	161.141.181.141
aa.10781.info.		600	IN	A	161.141.181.142
aa.10781.info.		600	IN	A	161.141.181.143
aa.10781.info.		600	IN	A	161.141.181.144
aa.10781.info.		600	IN	A	161.141.181.145
aa.10781.info.		600	IN	A	161.141.181.146
aa.10781.info.		600	IN	A	161.141.181.147
aa.10781.info.		600	IN	A	161.141.181.148
aa.10781.info.		600	IN	A	161.141.181.149
aa.10781.info.		600	IN	A	161.141.181.150
aa.10781.info.		600	IN	A	161.141.181.151
aa.10781.info.		600	IN	A	161.141.181.152
aa.10781.info.		600	IN	A	161.141.181.153
aa.10781.info.		600	IN	A	161.141.181.154
aa.10781.info.		600	IN	A	161.141.181.155
aa.10781.info.		600	IN	A	161.141.181.156
aa.10781.info.		600	IN	A	161.141.181.157
aa.10781.info.		600	IN	A	161.141.181.158
aa.10781.info.		600	IN	A	161.141.181.159
aa.10781.info.		600	IN	A	161.141.181.160
aa.10781.info.		600	IN	A	161.141.181.161
aa.10781.info.		600	IN	A	161.141.181.162
aa.10781.info.		600	IN	A	161.141.181.163
aa.10781.info.		600	IN	A	161.141.181.164
aa.10781.info.		600	IN	A	161.141.181.165
aa.10781.info.		600	IN	A	161.141.181.166
aa.10781.info.		600	IN	A	161.141.181.167
aa.10781.info.		600	IN	A	161.141.181.168
aa.10781.info.		600	IN	A	161.141.181.169
aa.10781.info.		600	IN	A	161.141.181.170
aa.10781.info.		600	IN	A	161.141.181.171
aa.10781.info.		600	IN	A	161.141.181.172
aa.10781.info.		600	IN	A	161.141.181.173
aa.10781.info.		600	IN	A	161.141.181.174
aa.10781.info.		600	IN	A	161.141.181.175
aa.10781.info.		600	IN	A	161.141.181.176
aa.10781.info.		600	IN	A	161.141.181.177
aa.10781.info.		600	IN	A	161.141.181.178
aa.10781.info.		600	IN	A	161.141.181.179
aa.10781.info.		600	IN	A	161.141.181.180
aa.10781.info.		600	IN	A	161.141.181.181
aa.10781.info.		600	IN	A	161.141.181.182
aa.10781.info.		600	IN	A	161.141.181.183
aa.10781.info.		600	IN	A	161.141.181.184
aa.10781.info.		600	IN	A	161.141.181.185
aa.10781.info.		600	IN	A	161.141.181.186
aa.10781.info.		600	IN	A	161.141.181.187
aa.10781.info.		600	IN	A	161.141.181.188
aa.10781.info.		600	IN	A	161.141.181.189
aa.10781.info.		600	IN	A	161.141.181.190
aa.10781.info.		600	IN	A	161.141.181.191
aa.10781.info.		600	IN	A	161.141.181.192
aa.10781.info.		600	IN	A	161.141.181.193
aa.10781.info.		600	IN	A	161.141.181.194
aa.10781.info.		600	IN	A	161.141.181.195
aa.10781.info.		600	IN	A	161.141.181.196
aa.10781.info.		600	IN	A	161.141.181.197
aa.10781.info.		600	IN	A	161.141.181.198
aa.10781.info.		600	IN	A	161.141.181.199
aa.10781.info.		600	IN	A	161.141.181.200
aa.10781.info.		600	IN	A	161.141.181.201
aa.10781.info.		600	IN	A	161.141.181.202
aa.10781.info.		600	IN	A	161.141.181.203
aa.10781.info.		600	IN	A	161.141.181.204
aa.10781.info.		600	IN	A	161.141.181.205
aa.10781.info.		600	IN	A	161.141.181.206
aa.10781.info.		600	IN	A	161.141.181.207
aa.10781.info.		600	IN	A	161.141.181.208
aa.10781.info.		600	IN	A	161.141.181.209
aa.10781.info.		600	IN	A	161.141.181.210
aa.10781.info.		600	IN	A	161.141.181.211
aa.10781.info.		600	IN	A	161.141.181.212
aa.10781.info.		600	IN	A	161.141.181.213
aa.10781.info.		600	IN	A	161.141.181.214
aa.10781.info.		600	IN	A	161.141.181.215
aa.10781.info.		600	IN	A	161.141.181.216
aa.10781.info.		600	IN	A	161.141.181.217
aa.10781.info.		600	IN	A	161.141.181.218
aa.10781.info.		600	IN	A	161.141.181.219
aa.10781.info.		600	IN	A	161.141.181.220
aa.10781.info.		600	IN	A	161.141.181.221
aa.10781.info.		600	IN	A	161.141.181.222
aa.10781.info.		600	IN	A	161.141.181.223
aa.10781.info.		600	IN	A	161.141.181.224
aa.10781.info.		600	IN	A	161.141.181.225
aa.10781.info.		600	IN	A	161.141.181.226
aa.10781.info.		600	IN	A	161.141.181.227
aa.10781.info.		600	IN	A	161.141.181.228
aa.10781.info.		600	IN	A	161.141.181.229
aa.10781.info.		600	IN	A	161.141.181.230
aa.10781.info.		600	IN	A	161.141.181.231
aa.10781.info.		600	IN	A	161.141.181.232
aa.10781.info.		600	IN	A	161.141.181.233
aa.10781.info.		600	IN	A	161.141.181.234
aa.10781.info.		600	IN	A	161.141.181.235
aa.10781.info.		600	IN	A	161.141.181.236
aa.10781.info.		600	IN	A	161.141.181.237
aa.10781.info.		600	IN	A	161.141.181.238
aa.10781.info.		600	IN	A	161.141.181.239
aa.10781.info.		600	IN	A	161.141.181.240
aa.10781.info.		600	IN	A	161.141.181.241
aa.10781.info.		600	IN	A	161.141.181.242
aa.10781.info.		600	IN	A	161.141.181.243
aa.10781.info.		600	IN	A	161.141.181.244
aa.10781.info.		600	IN	A	161.141.181.245
aa.10781.info.		600	IN	A	161.141.181.246
aa.10781.info.		600	IN	A	161.141.181.247
aa.10781.info.		600	IN	A	161.141.181.248
aa.10781.info.		600	IN	A	161.141.181.249

;; AUTHORITY SECTION:
10781.info.		6276	IN	NS	ns2.05930.info.
10781.info.		6276	IN	NS	ns1.05930.info.

;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Oct  9 23:50:48 2013
;; MSG SIZE  rcvd: 4169
$ whois 64.62.186.77

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=64.62.186.77?showDetails=true&showARIN=false&ext=netref2
#


# start

NetRange:       64.62.128.0 - 64.62.255.255
CIDR:           64.62.128.0/17
OriginAS:       AS6939
NetName:        HURRICANE-4
NetHandle:      NET-64-62-128-0-1
Parent:         NET-64-0-0-0-0
NetType:        Direct Allocation
Comment:        ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:        2002-08-27
Updated:        2012-02-24
Ref:            http://whois.arin.net/rest/net/NET-64-62-128-0-1

OrgName:        Hurricane Electric, Inc.
OrgId:          HURC
Address:        760 Mission Court
City:           Fremont
StateProv:      CA
PostalCode:     94539
Country:        US
RegDate:        
Updated:        2011-04-13
Ref:            http://whois.arin.net/rest/org/HURC

ReferralServer: rwhois://rwhois.he.net:4321

OrgTechHandle: ZH17-ARIN
OrgTechName:   Hurricane Electric
OrgTechPhone:  +1-510-580-4100 
OrgTechEmail:  hostmaster@he.net
OrgTechRef:    http://whois.arin.net/rest/poc/ZH17-ARIN

OrgAbuseHandle: ABUSE1036-ARIN
OrgAbuseName:   Abuse Department
OrgAbusePhone:  +1-510-580-4100 
OrgAbuseEmail:  abuse@he.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE1036-ARIN

RNOCHandle: ZH17-ARIN
RNOCName:   Hurricane Electric
RNOCPhone:  +1-510-580-4100 
RNOCEmail:  hostmaster@he.net
RNOCRef:    http://whois.arin.net/rest/poc/ZH17-ARIN

RAbuseHandle: ABUSE1036-ARIN
RAbuseName:   Abuse Department
RAbusePhone:  +1-510-580-4100 
RAbuseEmail:  abuse@he.net
RAbuseRef:    http://whois.arin.net/rest/poc/ABUSE1036-ARIN

RTechHandle: ZH17-ARIN
RTechName:   Hurricane Electric
RTechPhone:  +1-510-580-4100 
RTechEmail:  hostmaster@he.net
RTechRef:    http://whois.arin.net/rest/poc/ZH17-ARIN

# end


# start

NetRange:       64.62.186.0 - 64.62.186.255
CIDR:           64.62.186.0/24
OriginAS:       AS62466
NetName:        CLEARDDOS-DC1002-403EBA00
NetHandle:      NET-64-62-186-0-1
Parent:         NET-64-62-128-0-1
NetType:        Reallocated
Comment:        www.clear-ddos.com
RegDate:        2013-08-13
Updated:        2013-08-18
Ref:            http://whois.arin.net/rest/net/NET-64-62-186-0-1

OrgName:        ClearDDoS Technologies
OrgId:          GFSL-6
Address:        215-5625 Senlac Street
City:           Vancouver
StateProv:      BC
PostalCode:     V5R-6G8
Country:        CA
RegDate:        2012-10-12
Updated:        2013-09-09
Comment:        www.clear-ddos.com
Ref:            http://whois.arin.net/rest/org/GFSL-6

OrgNOCHandle: DAIDE-ARIN
OrgNOCName:   Dai, Dennis 
OrgNOCPhone:  +1-604-639-7533 
OrgNOCEmail:  support@clear-ddos.com
OrgNOCRef:    http://whois.arin.net/rest/poc/DAIDE-ARIN

OrgAbuseHandle: DAIDE-ARIN
OrgAbuseName:   Dai, Dennis 
OrgAbusePhone:  +1-604-639-7533 
OrgAbuseEmail:  support@clear-ddos.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/DAIDE-ARIN

OrgTechHandle: DAIDE-ARIN
OrgTechName:   Dai, Dennis 
OrgTechPhone:  +1-604-639-7533 
OrgTechEmail:  support@clear-ddos.com
OrgTechRef:    http://whois.arin.net/rest/poc/DAIDE-ARIN

# end



#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#



rwhois.he.net:4321 への照会をみつけました

%rwhois V-1.5:0012b7:01 ops.he.net (HE-RWHOISd v:r255,m1:r319)
network:ID;I:NET-64.62.186.0/24
network:Auth-Area:nets
network:Class-Name:network
network:Network-Name;I:NET-64.62.186.0/24
network:Parent;I:NET-64.62.128.0/17
network:IP-Network:64.62.186.0/24
network:Org-Contact;I:POC-DC-1002
network:Tech-Contact;I:POC-HE-NOC
network:Abuse-Contact;I:POC-HE-ABUSE
network:NOC-Contact;I:POC-HE-NOC
network:Created:20130807203009000
network:Updated:20130807203009000

contact:ID;I:POC-DC-1002
contact:Auth-Area:contacts
contact:Class-Name:contact
contact:Name:Guoqiang Dai
contact:Company:Clear DDoS
contact:Street-Address:215-5625 Senlac St.
contact:City:Vancouver
contact:Province:BC
contact:Postal-Code:V5R-6G8
contact:Country-Code:CA
contact:Phone:604-639-7533
contact:E-Mail:ddai@ddai.net
contact:Created:20130807163002000
contact:Updated:20130807163002000

contact:ID;I:POC-HE-NOC
contact:Auth-Area:contacts
contact:Class-Name:contact
contact:Name:Network Operations Center
contact:Company:Hurricane Electric
contact:Street-Address:760 Mission Ct
contact:City:Fremont
contact:Province:CA
contact:Postal-Code:94539
contact:Country-Code:US
contact:Phone:+1-510-580-4100
contact:E-Mail:noc@he.net
contact:Created:20100901200738000
contact:Updated:20100901200738000

contact:ID;I:POC-HE-ABUSE
contact:Auth-Area:contacts
contact:Class-Name:contact
contact:Name:Abuse Department
contact:Company:Hurricane Electric
contact:Street-Address:760 Mission Ct
contact:City:Fremont
contact:Province:CA
contact:Postal-Code:94539
contact:Country-Code:US
contact:Phone:+1-510-580-4100
contact:E-Mail:abuse@he.net
contact:Created:20100901200738000
contact:Updated:20100901200738000
contact:Comment:For email abuse (spam) only

DNSアンプ攻撃観測 (hizbullah.me)

ブラジル発の怪しいドメイン.

$ dig @127.0.0.1 hizbullah.me any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.6-P1 <<>> @127.0.0.1 hizbullah.me any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28928
;; flags: qr rd ra; QUERY: 1, ANSWER: 244, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;hizbullah.me.			IN	ANY

;; ANSWER SECTION:
hizbullah.me.		1800	IN	NS	ns1.hizbullah.me.
hizbullah.me.		1800	IN	A	204.46.43.203
hizbullah.me.		1800	IN	A	204.46.43.204
hizbullah.me.		1800	IN	A	204.46.43.205
hizbullah.me.		1800	IN	A	204.46.43.206
hizbullah.me.		1800	IN	A	204.46.43.207
hizbullah.me.		1800	IN	A	204.46.43.208
hizbullah.me.		1800	IN	A	204.46.43.209
hizbullah.me.		1800	IN	A	204.46.43.210
hizbullah.me.		1800	IN	A	204.46.43.211
hizbullah.me.		1800	IN	A	204.46.43.212
hizbullah.me.		1800	IN	A	204.46.43.213
hizbullah.me.		1800	IN	A	204.46.43.214
hizbullah.me.		1800	IN	A	204.46.43.215
hizbullah.me.		1800	IN	A	204.46.43.216
hizbullah.me.		1800	IN	A	204.46.43.217
hizbullah.me.		1800	IN	A	204.46.43.218
hizbullah.me.		1800	IN	A	204.46.43.219
hizbullah.me.		1800	IN	A	204.46.43.220
hizbullah.me.		1800	IN	A	204.46.43.221
hizbullah.me.		1800	IN	A	204.46.43.222
hizbullah.me.		1800	IN	A	204.46.43.223
hizbullah.me.		1800	IN	A	204.46.43.224
hizbullah.me.		1800	IN	A	204.46.43.225
hizbullah.me.		1800	IN	A	204.46.43.226
hizbullah.me.		1800	IN	A	204.46.43.227
hizbullah.me.		1800	IN	A	204.46.43.228
hizbullah.me.		1800	IN	A	204.46.43.229
hizbullah.me.		1800	IN	A	204.46.43.230
hizbullah.me.		1800	IN	A	204.46.43.231
hizbullah.me.		1800	IN	A	204.46.43.232
hizbullah.me.		1800	IN	A	204.46.43.233
hizbullah.me.		1800	IN	A	204.46.43.234
hizbullah.me.		1800	IN	A	204.46.43.235
hizbullah.me.		1800	IN	A	204.46.43.236
hizbullah.me.		1800	IN	A	204.46.43.237
hizbullah.me.		1800	IN	A	204.46.43.238
hizbullah.me.		1800	IN	A	204.46.43.239
hizbullah.me.		1800	IN	A	204.46.43.240
hizbullah.me.		1800	IN	A	204.46.43.241
hizbullah.me.		1800	IN	A	204.46.43.242
hizbullah.me.		1800	IN	A	204.46.43.1
hizbullah.me.		1800	IN	A	204.46.43.2
hizbullah.me.		1800	IN	A	204.46.43.3
hizbullah.me.		1800	IN	A	204.46.43.4
hizbullah.me.		1800	IN	A	204.46.43.5
hizbullah.me.		1800	IN	A	204.46.43.6
hizbullah.me.		1800	IN	A	204.46.43.7
hizbullah.me.		1800	IN	A	204.46.43.8
hizbullah.me.		1800	IN	A	204.46.43.9
hizbullah.me.		1800	IN	A	204.46.43.10
hizbullah.me.		1800	IN	A	204.46.43.11
hizbullah.me.		1800	IN	A	204.46.43.12
hizbullah.me.		1800	IN	A	204.46.43.13
hizbullah.me.		1800	IN	A	204.46.43.14
hizbullah.me.		1800	IN	A	204.46.43.15
hizbullah.me.		1800	IN	A	204.46.43.16
hizbullah.me.		1800	IN	A	204.46.43.17
hizbullah.me.		1800	IN	A	204.46.43.18
hizbullah.me.		1800	IN	A	204.46.43.19
hizbullah.me.		1800	IN	A	204.46.43.20
hizbullah.me.		1800	IN	A	204.46.43.21
hizbullah.me.		1800	IN	A	204.46.43.22
hizbullah.me.		1800	IN	A	204.46.43.23
hizbullah.me.		1800	IN	A	204.46.43.24
hizbullah.me.		1800	IN	A	204.46.43.25
hizbullah.me.		1800	IN	A	204.46.43.26
hizbullah.me.		1800	IN	A	204.46.43.27
hizbullah.me.		1800	IN	A	204.46.43.28
hizbullah.me.		1800	IN	A	204.46.43.29
hizbullah.me.		1800	IN	A	204.46.43.30
hizbullah.me.		1800	IN	A	204.46.43.31
hizbullah.me.		1800	IN	A	204.46.43.32
hizbullah.me.		1800	IN	A	204.46.43.33
hizbullah.me.		1800	IN	A	204.46.43.34
hizbullah.me.		1800	IN	A	204.46.43.35
hizbullah.me.		1800	IN	A	204.46.43.36
hizbullah.me.		1800	IN	A	204.46.43.37
hizbullah.me.		1800	IN	A	204.46.43.38
hizbullah.me.		1800	IN	A	204.46.43.39
hizbullah.me.		1800	IN	A	204.46.43.40
hizbullah.me.		1800	IN	A	204.46.43.41
hizbullah.me.		1800	IN	A	204.46.43.42
hizbullah.me.		1800	IN	A	204.46.43.43
hizbullah.me.		1800	IN	A	204.46.43.44
hizbullah.me.		1800	IN	A	204.46.43.45
hizbullah.me.		1800	IN	A	204.46.43.46
hizbullah.me.		1800	IN	A	204.46.43.47
hizbullah.me.		1800	IN	A	204.46.43.48
hizbullah.me.		1800	IN	A	204.46.43.49
hizbullah.me.		1800	IN	A	204.46.43.50
hizbullah.me.		1800	IN	A	204.46.43.51
hizbullah.me.		1800	IN	A	204.46.43.52
hizbullah.me.		1800	IN	A	204.46.43.53
hizbullah.me.		1800	IN	A	204.46.43.54
hizbullah.me.		1800	IN	A	204.46.43.55
hizbullah.me.		1800	IN	A	204.46.43.56
hizbullah.me.		1800	IN	A	204.46.43.57
hizbullah.me.		1800	IN	A	204.46.43.58
hizbullah.me.		1800	IN	A	204.46.43.59
hizbullah.me.		1800	IN	A	204.46.43.60
hizbullah.me.		1800	IN	A	204.46.43.61
hizbullah.me.		1800	IN	A	204.46.43.62
hizbullah.me.		1800	IN	A	204.46.43.63
hizbullah.me.		1800	IN	A	204.46.43.64
hizbullah.me.		1800	IN	A	204.46.43.65
hizbullah.me.		1800	IN	A	204.46.43.66
hizbullah.me.		1800	IN	A	204.46.43.67
hizbullah.me.		1800	IN	A	204.46.43.68
hizbullah.me.		1800	IN	A	204.46.43.69
hizbullah.me.		1800	IN	A	204.46.43.70
hizbullah.me.		1800	IN	A	204.46.43.71
hizbullah.me.		1800	IN	A	204.46.43.72
hizbullah.me.		1800	IN	A	204.46.43.73
hizbullah.me.		1800	IN	A	204.46.43.74
hizbullah.me.		1800	IN	A	204.46.43.75
hizbullah.me.		1800	IN	A	204.46.43.76
hizbullah.me.		1800	IN	A	204.46.43.77
hizbullah.me.		1800	IN	A	204.46.43.78
hizbullah.me.		1800	IN	A	204.46.43.79
hizbullah.me.		1800	IN	A	204.46.43.80
hizbullah.me.		1800	IN	A	204.46.43.81
hizbullah.me.		1800	IN	A	204.46.43.82
hizbullah.me.		1800	IN	A	204.46.43.83
hizbullah.me.		1800	IN	A	204.46.43.84
hizbullah.me.		1800	IN	A	204.46.43.85
hizbullah.me.		1800	IN	A	204.46.43.86
hizbullah.me.		1800	IN	A	204.46.43.87
hizbullah.me.		1800	IN	A	204.46.43.88
hizbullah.me.		1800	IN	A	204.46.43.89
hizbullah.me.		1800	IN	A	204.46.43.90
hizbullah.me.		1800	IN	A	204.46.43.91
hizbullah.me.		1800	IN	A	204.46.43.92
hizbullah.me.		1800	IN	A	204.46.43.93
hizbullah.me.		1800	IN	A	204.46.43.94
hizbullah.me.		1800	IN	A	204.46.43.95
hizbullah.me.		1800	IN	A	204.46.43.96
hizbullah.me.		1800	IN	A	204.46.43.97
hizbullah.me.		1800	IN	A	204.46.43.98
hizbullah.me.		1800	IN	A	204.46.43.99
hizbullah.me.		1800	IN	A	204.46.43.100
hizbullah.me.		1800	IN	A	204.46.43.101
hizbullah.me.		1800	IN	A	204.46.43.102
hizbullah.me.		1800	IN	A	204.46.43.103
hizbullah.me.		1800	IN	A	204.46.43.104
hizbullah.me.		1800	IN	A	204.46.43.105
hizbullah.me.		1800	IN	A	204.46.43.106
hizbullah.me.		1800	IN	A	204.46.43.107
hizbullah.me.		1800	IN	A	204.46.43.108
hizbullah.me.		1800	IN	A	204.46.43.109
hizbullah.me.		1800	IN	A	204.46.43.110
hizbullah.me.		1800	IN	A	204.46.43.111
hizbullah.me.		1800	IN	A	204.46.43.112
hizbullah.me.		1800	IN	A	204.46.43.113
hizbullah.me.		1800	IN	A	204.46.43.114
hizbullah.me.		1800	IN	A	204.46.43.115
hizbullah.me.		1800	IN	A	204.46.43.116
hizbullah.me.		1800	IN	A	204.46.43.117
hizbullah.me.		1800	IN	A	204.46.43.118
hizbullah.me.		1800	IN	A	204.46.43.119
hizbullah.me.		1800	IN	A	204.46.43.120
hizbullah.me.		1800	IN	A	204.46.43.121
hizbullah.me.		1800	IN	A	204.46.43.122
hizbullah.me.		1800	IN	A	204.46.43.123
hizbullah.me.		1800	IN	A	204.46.43.124
hizbullah.me.		1800	IN	A	204.46.43.125
hizbullah.me.		1800	IN	A	204.46.43.126
hizbullah.me.		1800	IN	A	204.46.43.127
hizbullah.me.		1800	IN	A	204.46.43.128
hizbullah.me.		1800	IN	A	204.46.43.129
hizbullah.me.		1800	IN	A	204.46.43.130
hizbullah.me.		1800	IN	A	204.46.43.131
hizbullah.me.		1800	IN	A	204.46.43.132
hizbullah.me.		1800	IN	A	204.46.43.133
hizbullah.me.		1800	IN	A	204.46.43.134
hizbullah.me.		1800	IN	A	204.46.43.135
hizbullah.me.		1800	IN	A	204.46.43.136
hizbullah.me.		1800	IN	A	204.46.43.137
hizbullah.me.		1800	IN	A	204.46.43.138
hizbullah.me.		1800	IN	A	204.46.43.139
hizbullah.me.		1800	IN	A	204.46.43.140
hizbullah.me.		1800	IN	A	204.46.43.141
hizbullah.me.		1800	IN	A	204.46.43.142
hizbullah.me.		1800	IN	A	204.46.43.143
hizbullah.me.		1800	IN	A	204.46.43.144
hizbullah.me.		1800	IN	A	204.46.43.145
hizbullah.me.		1800	IN	A	204.46.43.146
hizbullah.me.		1800	IN	A	204.46.43.147
hizbullah.me.		1800	IN	A	204.46.43.148
hizbullah.me.		1800	IN	A	204.46.43.149
hizbullah.me.		1800	IN	A	204.46.43.150
hizbullah.me.		1800	IN	A	204.46.43.151
hizbullah.me.		1800	IN	A	204.46.43.152
hizbullah.me.		1800	IN	A	204.46.43.153
hizbullah.me.		1800	IN	A	204.46.43.154
hizbullah.me.		1800	IN	A	204.46.43.155
hizbullah.me.		1800	IN	A	204.46.43.156
hizbullah.me.		1800	IN	A	204.46.43.157
hizbullah.me.		1800	IN	A	204.46.43.158
hizbullah.me.		1800	IN	A	204.46.43.159
hizbullah.me.		1800	IN	A	204.46.43.160
hizbullah.me.		1800	IN	A	204.46.43.161
hizbullah.me.		1800	IN	A	204.46.43.162
hizbullah.me.		1800	IN	A	204.46.43.163
hizbullah.me.		1800	IN	A	204.46.43.164
hizbullah.me.		1800	IN	A	204.46.43.165
hizbullah.me.		1800	IN	A	204.46.43.166
hizbullah.me.		1800	IN	A	204.46.43.167
hizbullah.me.		1800	IN	A	204.46.43.168
hizbullah.me.		1800	IN	A	204.46.43.169
hizbullah.me.		1800	IN	A	204.46.43.170
hizbullah.me.		1800	IN	A	204.46.43.171
hizbullah.me.		1800	IN	A	204.46.43.172
hizbullah.me.		1800	IN	A	204.46.43.173
hizbullah.me.		1800	IN	A	204.46.43.174
hizbullah.me.		1800	IN	A	204.46.43.175
hizbullah.me.		1800	IN	A	204.46.43.176
hizbullah.me.		1800	IN	A	204.46.43.177
hizbullah.me.		1800	IN	A	204.46.43.178
hizbullah.me.		1800	IN	A	204.46.43.179
hizbullah.me.		1800	IN	A	204.46.43.180
hizbullah.me.		1800	IN	A	204.46.43.181
hizbullah.me.		1800	IN	A	204.46.43.182
hizbullah.me.		1800	IN	A	204.46.43.183
hizbullah.me.		1800	IN	A	204.46.43.184
hizbullah.me.		1800	IN	A	204.46.43.185
hizbullah.me.		1800	IN	A	204.46.43.186
hizbullah.me.		1800	IN	A	204.46.43.187
hizbullah.me.		1800	IN	A	204.46.43.188
hizbullah.me.		1800	IN	A	204.46.43.189
hizbullah.me.		1800	IN	A	204.46.43.190
hizbullah.me.		1800	IN	A	204.46.43.191
hizbullah.me.		1800	IN	A	204.46.43.192
hizbullah.me.		1800	IN	A	204.46.43.193
hizbullah.me.		1800	IN	A	204.46.43.194
hizbullah.me.		1800	IN	A	204.46.43.195
hizbullah.me.		1800	IN	A	204.46.43.196
hizbullah.me.		1800	IN	A	204.46.43.197
hizbullah.me.		1800	IN	A	204.46.43.198
hizbullah.me.		1800	IN	A	204.46.43.199
hizbullah.me.		1800	IN	A	204.46.43.200
hizbullah.me.		1800	IN	A	204.46.43.201
hizbullah.me.		1800	IN	A	204.46.43.202
hizbullah.me.		86400	IN	SOA	ns1.hizbullah.me. admin.hizbullah.me. 2012292301 28800 86400 3600000 86400

;; ADDITIONAL SECTION:
ns1.hizbullah.me.	1800	IN	A	200.241.86.132

;; Query time: 12 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Oct  9 10:33:14 2013
;; MSG SIZE  rcvd: 3978
$ whois 200.241.86.132

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 200.241.86.132"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=200.241.86.132?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       200.0.0.0 - 200.255.255.255
CIDR:           200.0.0.0/8
OriginAS:
NetName:        LACNIC-200
NetHandle:      NET-200-0-0-0-1
Parent:
NetType:        Allocated to LACNIC
Comment:        This IP address range is under LACNIC responsibility for further
Comment:        allocations to users in LACNIC region.
Comment:        Please see http://www.lacnic.net/ for further details, or check the
Comment:        WHOIS server located at http://whois.lacnic.net
RegDate:        2002-07-27
Updated:        2010-07-21
Ref:            http://whois.arin.net/rest/net/NET-200-0-0-0-1

OrgName:        Latin American and Caribbean IP address Regional Registry
OrgId:          LACNIC
Address:        Rambla Republica de Mexico 6125
City:           Montevideo
StateProv:
PostalCode:     11400
Country:        UY
RegDate:        2002-07-27
Updated:        2011-09-24
Ref:            http://whois.arin.net/rest/org/LACNIC

ReferralServer: whois://whois.lacnic.net

OrgAbuseHandle: LACNIC-ARIN
OrgAbuseName:   LACNIC Whois Info
OrgAbusePhone:  999-999-9999
OrgAbuseEmail:  whois-contact@lacnic.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/LACNIC-ARIN

OrgTechHandle: LACNIC-ARIN
OrgTechName:   LACNIC Whois Info
OrgTechPhone:  999-999-9999
OrgTechEmail:  whois-contact@lacnic.net
OrgTechRef:    http://whois.arin.net/rest/poc/LACNIC-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


% Joint Whois - whois.lacnic.net
%  This server accepts single ASN, IPv4 or IPv6 queries

% Brazilian resource: whois.registro.br


% Copyright (c) Nic.br
%  The use of the data below is only permitted as described in
%  full by the terms of use (http://registro.br/termo/en.html),
%  being prohibited its distribution, comercialization or
%  reproduction, in particular, to use it for advertising or
%  any similar purpose.
%  2013-10-08 22:36:52 (BRT -03:00)

inetnum:     200.241.86.128/26
aut-num:     AS4230
abuse-c:     GSE6
owner:       fundacao de previdencia complementar
ownerid:     007.009.152/0001-02
responsible: fernando calvet
country:     BR
owner-c:     FMC217
tech-c:      FMC217
created:     20040123
changed:     20130307
inetnum-up:  200.241/16

nic-hdl-br:  FMC217
person:      fernando messias calvet
e-mail:      egitf@zipmail.com.br
created:     20031112
changed:     20031112

nic-hdl-br:  GSE6
person:      Grupo de Seguran�a Internet da Embratel
e-mail:      abuse@embratel.net.br
created:     20001005
changed:     20001005

% Security and mail abuse issues should also be addressed to
% cert.br, http://www.cert.br/, respectivelly to cert@cert.br
% and mail-abuse@cert.br
%
% whois.registro.br accepts only direct match queries. Types
% of queries are: domain (.br), registrant (tax ID), ticket,
% provider, contact handle (ID), CIDR block, IP and ASN.

2013-10-07

DNSアンプ攻撃観測 (379zc.com ANY)

新しいAレコード割当ての形.

$ dig @127.0.0.1 379zc.com any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.6-P1 <<>> @127.0.0.1 379zc.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54012
;; flags: qr rd ra; QUERY: 1, ANSWER: 261, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;379zc.com.			IN	ANY

;; ANSWER SECTION:
379zc.com.		3857	IN	A	162.208.166.144
379zc.com.		3857	IN	A	162.208.166.145
379zc.com.		3857	IN	A	162.208.166.146
379zc.com.		3857	IN	A	162.208.166.147
379zc.com.		3857	IN	A	162.208.166.148
379zc.com.		3857	IN	A	162.208.166.149
379zc.com.		3857	IN	A	162.208.166.150
379zc.com.		3857	IN	A	162.208.166.151
379zc.com.		3857	IN	A	162.208.166.152
379zc.com.		3857	IN	A	162.208.166.153
379zc.com.		3857	IN	A	162.208.166.154
379zc.com.		3857	IN	A	162.208.166.155
379zc.com.		3857	IN	A	162.208.166.156
379zc.com.		3857	IN	A	162.208.166.157
379zc.com.		3857	IN	A	162.208.166.158
379zc.com.		3857	IN	A	162.208.166.159
379zc.com.		3857	IN	A	162.208.166.160
379zc.com.		3857	IN	A	162.208.166.161
379zc.com.		3857	IN	A	162.208.166.162
379zc.com.		3857	IN	A	162.208.166.163
379zc.com.		3857	IN	A	162.208.166.164
379zc.com.		3857	IN	A	162.208.166.165
379zc.com.		3857	IN	A	162.208.166.166
379zc.com.		3857	IN	A	162.208.166.167
379zc.com.		3857	IN	A	162.208.166.168
379zc.com.		3857	IN	A	162.208.166.169
379zc.com.		3857	IN	A	162.208.166.170
379zc.com.		3857	IN	A	162.208.166.171
379zc.com.		3857	IN	A	162.208.166.172
379zc.com.		3857	IN	A	162.208.166.173
379zc.com.		3857	IN	A	162.208.166.174
379zc.com.		3857	IN	A	162.208.166.175
379zc.com.		3857	IN	A	162.208.166.176
379zc.com.		3857	IN	A	162.208.166.177
379zc.com.		3857	IN	A	162.208.166.178
379zc.com.		3857	IN	A	162.208.166.179
379zc.com.		3857	IN	A	162.208.166.180
379zc.com.		3857	IN	A	162.208.166.181
379zc.com.		3857	IN	A	162.208.166.182
379zc.com.		3857	IN	A	162.208.166.183
379zc.com.		3857	IN	A	162.208.166.184
379zc.com.		3857	IN	A	162.208.166.185
379zc.com.		3857	IN	A	162.208.166.186
379zc.com.		3857	IN	A	162.208.166.187
379zc.com.		3857	IN	A	162.208.166.188
379zc.com.		3857	IN	A	162.208.166.189
379zc.com.		3857	IN	A	162.208.166.190
379zc.com.		3857	IN	A	162.208.166.191
379zc.com.		3857	IN	A	162.208.166.192
379zc.com.		3857	IN	A	162.208.166.193
379zc.com.		3857	IN	A	162.208.166.194
379zc.com.		3857	IN	A	162.208.166.195
379zc.com.		3857	IN	A	162.208.166.196
379zc.com.		3857	IN	A	162.208.166.197
379zc.com.		3857	IN	A	162.208.166.198
379zc.com.		3857	IN	A	162.208.166.199
379zc.com.		3857	IN	A	162.208.166.200
379zc.com.		3857	IN	A	162.208.165.100
379zc.com.		3857	IN	A	162.208.165.101
379zc.com.		3857	IN	A	162.208.165.102
379zc.com.		3857	IN	A	162.208.165.103
379zc.com.		3857	IN	A	162.208.165.104
379zc.com.		3857	IN	A	162.208.165.105
379zc.com.		3857	IN	A	162.208.165.106
379zc.com.		3857	IN	A	162.208.165.107
379zc.com.		3857	IN	A	162.208.165.108
379zc.com.		3857	IN	A	162.208.165.109
379zc.com.		3857	IN	A	162.208.165.110
379zc.com.		3857	IN	A	162.208.165.111
379zc.com.		3857	IN	A	162.208.165.112
379zc.com.		3857	IN	A	162.208.165.113
379zc.com.		3857	IN	A	162.208.165.114
379zc.com.		3857	IN	A	162.208.165.115
379zc.com.		3857	IN	A	162.208.165.116
379zc.com.		3857	IN	A	162.208.165.117
379zc.com.		3857	IN	A	162.208.165.118
379zc.com.		3857	IN	A	162.208.165.119
379zc.com.		3857	IN	A	162.208.165.120
379zc.com.		3857	IN	A	162.208.165.121
379zc.com.		3857	IN	A	162.208.165.122
379zc.com.		3857	IN	A	162.208.165.123
379zc.com.		3857	IN	A	162.208.165.124
379zc.com.		3857	IN	A	162.208.165.125
379zc.com.		3857	IN	A	162.208.165.126
379zc.com.		3857	IN	A	162.208.165.127
379zc.com.		3857	IN	A	162.208.165.128
379zc.com.		3857	IN	A	162.208.165.129
379zc.com.		3857	IN	A	162.208.165.130
379zc.com.		3857	IN	A	162.208.165.131
379zc.com.		3857	IN	A	162.208.165.132
379zc.com.		3857	IN	A	162.208.165.133
379zc.com.		3857	IN	A	162.208.165.134
379zc.com.		3857	IN	A	162.208.165.135
379zc.com.		3857	IN	A	162.208.165.136
379zc.com.		3857	IN	A	162.208.165.137
379zc.com.		3857	IN	A	162.208.165.138
379zc.com.		3857	IN	A	162.208.165.139
379zc.com.		3857	IN	A	162.208.165.140
379zc.com.		3857	IN	A	162.208.165.141
379zc.com.		3857	IN	A	162.208.165.142
379zc.com.		3857	IN	A	162.208.165.143
379zc.com.		3857	IN	A	162.208.165.144
379zc.com.		3857	IN	A	162.208.165.145
379zc.com.		3857	IN	A	162.208.165.146
379zc.com.		3857	IN	A	162.208.165.147
379zc.com.		3857	IN	A	162.208.165.148
379zc.com.		3857	IN	A	162.208.165.149
379zc.com.		3857	IN	A	162.208.165.150
379zc.com.		3857	IN	A	162.208.165.151
379zc.com.		3857	IN	A	162.208.165.152
379zc.com.		3857	IN	A	162.208.165.153
379zc.com.		3857	IN	A	162.208.165.154
379zc.com.		3857	IN	A	162.208.165.155
379zc.com.		3857	IN	A	162.208.165.156
379zc.com.		3857	IN	A	162.208.165.157
379zc.com.		3857	IN	A	162.208.165.158
379zc.com.		3857	IN	A	162.208.165.159
379zc.com.		3857	IN	A	162.208.165.160
379zc.com.		3857	IN	A	162.208.165.161
379zc.com.		3857	IN	A	162.208.165.162
379zc.com.		3857	IN	A	162.208.165.163
379zc.com.		3857	IN	A	162.208.165.164
379zc.com.		3857	IN	A	162.208.165.165
379zc.com.		3857	IN	A	162.208.165.166
379zc.com.		3857	IN	A	162.208.165.167
379zc.com.		3857	IN	A	162.208.165.168
379zc.com.		3857	IN	A	162.208.165.169
379zc.com.		3857	IN	A	162.208.165.170
379zc.com.		3857	IN	A	162.208.165.171
379zc.com.		3857	IN	A	162.208.165.172
379zc.com.		3857	IN	A	162.208.165.173
379zc.com.		3857	IN	A	162.208.165.174
379zc.com.		3857	IN	A	162.208.165.175
379zc.com.		3857	IN	A	162.208.165.176
379zc.com.		3857	IN	A	162.208.165.177
379zc.com.		3857	IN	A	162.208.165.178
379zc.com.		3857	IN	A	162.208.165.179
379zc.com.		3857	IN	A	162.208.165.180
379zc.com.		3857	IN	A	162.208.165.181
379zc.com.		3857	IN	A	162.208.165.182
379zc.com.		3857	IN	A	162.208.165.183
379zc.com.		3857	IN	A	162.208.165.184
379zc.com.		3857	IN	A	162.208.165.185
379zc.com.		3857	IN	A	162.208.165.186
379zc.com.		3857	IN	A	162.208.165.187
379zc.com.		3857	IN	A	162.208.165.188
379zc.com.		3857	IN	A	162.208.165.189
379zc.com.		3857	IN	A	162.208.165.190
379zc.com.		3857	IN	A	162.208.165.191
379zc.com.		3857	IN	A	162.208.165.192
379zc.com.		3857	IN	A	162.208.165.193
379zc.com.		3857	IN	A	162.208.165.194
379zc.com.		3857	IN	A	162.208.165.195
379zc.com.		3857	IN	A	162.208.165.196
379zc.com.		3857	IN	A	162.208.165.197
379zc.com.		3857	IN	A	162.208.165.198
379zc.com.		3857	IN	A	162.208.165.199
379zc.com.		3857	IN	A	162.208.165.200
379zc.com.		3857	IN	A	162.208.165.201
379zc.com.		3857	IN	A	162.208.165.202
379zc.com.		3857	IN	A	162.208.165.203
379zc.com.		3857	IN	A	162.208.165.204
379zc.com.		3857	IN	A	162.208.165.205
379zc.com.		3857	IN	A	162.208.165.206
379zc.com.		3857	IN	A	162.208.165.207
379zc.com.		3857	IN	A	162.208.165.208
379zc.com.		3857	IN	A	162.208.165.209
379zc.com.		3857	IN	A	162.208.165.210
379zc.com.		3857	IN	A	162.208.165.211
379zc.com.		3857	IN	A	162.208.165.212
379zc.com.		3857	IN	A	162.208.165.213
379zc.com.		3857	IN	A	162.208.165.214
379zc.com.		3857	IN	A	162.208.165.215
379zc.com.		3857	IN	A	162.208.165.216
379zc.com.		3857	IN	A	162.208.165.217
379zc.com.		3857	IN	A	162.208.165.218
379zc.com.		3857	IN	A	162.208.165.219
379zc.com.		3857	IN	A	162.208.165.220
379zc.com.		3857	IN	A	162.208.165.221
379zc.com.		3857	IN	A	162.208.165.222
379zc.com.		3857	IN	A	162.208.165.223
379zc.com.		3857	IN	A	162.208.165.224
379zc.com.		3857	IN	A	162.208.165.225
379zc.com.		3857	IN	A	162.208.165.226
379zc.com.		3857	IN	A	162.208.165.227
379zc.com.		3857	IN	A	162.208.165.228
379zc.com.		3857	IN	A	162.208.165.229
379zc.com.		3857	IN	A	162.208.165.230
379zc.com.		3857	IN	A	162.208.165.231
379zc.com.		3857	IN	A	162.208.165.232
379zc.com.		3857	IN	A	162.208.165.233
379zc.com.		3857	IN	A	162.208.165.234
379zc.com.		3857	IN	A	162.208.165.235
379zc.com.		3857	IN	A	162.208.165.236
379zc.com.		3857	IN	A	162.208.165.237
379zc.com.		3857	IN	A	162.208.165.238
379zc.com.		3857	IN	A	162.208.165.239
379zc.com.		3857	IN	A	162.208.165.240
379zc.com.		3857	IN	A	162.208.165.241
379zc.com.		3857	IN	A	162.208.165.242
379zc.com.		3857	IN	A	162.208.165.243
379zc.com.		3857	IN	A	162.208.165.244
379zc.com.		3857	IN	A	162.208.165.245
379zc.com.		3857	IN	A	162.208.165.246
379zc.com.		3857	IN	A	162.208.165.247
379zc.com.		3857	IN	A	162.208.165.248
379zc.com.		3857	IN	A	162.208.165.249
379zc.com.		3857	IN	A	162.208.165.250
379zc.com.		3857	IN	A	162.208.165.251
379zc.com.		3857	IN	A	162.208.165.252
379zc.com.		3857	IN	A	162.208.165.253
379zc.com.		3857	IN	A	162.208.165.254
379zc.com.		3857	IN	A	162.208.166.100
379zc.com.		3857	IN	A	162.208.166.101
379zc.com.		3857	IN	A	162.208.166.102
379zc.com.		3857	IN	A	162.208.166.103
379zc.com.		3857	IN	A	162.208.166.104
379zc.com.		3857	IN	A	162.208.166.105
379zc.com.		3857	IN	A	162.208.166.106
379zc.com.		3857	IN	A	162.208.166.107
379zc.com.		3857	IN	A	162.208.166.108
379zc.com.		3857	IN	A	162.208.166.109
379zc.com.		3857	IN	A	162.208.166.110
379zc.com.		3857	IN	A	162.208.166.111
379zc.com.		3857	IN	A	162.208.166.112
379zc.com.		3857	IN	A	162.208.166.113
379zc.com.		3857	IN	A	162.208.166.114
379zc.com.		3857	IN	A	162.208.166.115
379zc.com.		3857	IN	A	162.208.166.116
379zc.com.		3857	IN	A	162.208.166.117
379zc.com.		3857	IN	A	162.208.166.118
379zc.com.		3857	IN	A	162.208.166.119
379zc.com.		3857	IN	A	162.208.166.120
379zc.com.		3857	IN	A	162.208.166.121
379zc.com.		3857	IN	A	162.208.166.122
379zc.com.		3857	IN	A	162.208.166.123
379zc.com.		3857	IN	A	162.208.166.124
379zc.com.		3857	IN	A	162.208.166.125
379zc.com.		3857	IN	A	162.208.166.126
379zc.com.		3857	IN	A	162.208.166.127
379zc.com.		3857	IN	A	162.208.166.128
379zc.com.		3857	IN	A	162.208.166.129
379zc.com.		3857	IN	A	162.208.166.130
379zc.com.		3857	IN	A	162.208.166.131
379zc.com.		3857	IN	A	162.208.166.132
379zc.com.		3857	IN	A	162.208.166.133
379zc.com.		3857	IN	A	162.208.166.134
379zc.com.		3857	IN	A	162.208.166.135
379zc.com.		3857	IN	A	162.208.166.136
379zc.com.		3857	IN	A	162.208.166.137
379zc.com.		3857	IN	A	162.208.166.138
379zc.com.		3857	IN	A	162.208.166.139
379zc.com.		3857	IN	A	162.208.166.140
379zc.com.		3857	IN	A	162.208.166.141
379zc.com.		3857	IN	A	162.208.166.142
379zc.com.		3857	IN	A	162.208.166.143
379zc.com.		5057	IN	SOA	ns1.mmtac1.com. root.ns1.379zc.com. 20091027 28800 600 604800 86400
379zc.com.		5057	IN	NS	ns3.mmtac1.com.
379zc.com.		5057	IN	NS	ns4.mmtac1.com.
379zc.com.		5057	IN	NS	ns1.mmtac1.com.
379zc.com.		5057	IN	NS	ns2.mmtac1.com.

;; Query time: 11 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Oct  7 15:55:35 2013
;; MSG SIZE  rcvd: 4247
$ whois 222.163.192.106

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 222.163.192.106"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=222.163.192.106?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       222.0.0.0 - 222.255.255.255
CIDR:           222.0.0.0/8
OriginAS:
NetName:        APNIC8
NetHandle:      NET-222-0-0-0-1
Parent:
NetType:        Allocated to APNIC
Comment:        This IP address range is not registered in the ARIN database.
Comment:        For details, refer to the APNIC Whois Database via
Comment:        WHOIS.APNIC.NET or http://wq.apnic.net/apnic-bin/whois.pl
Comment:        ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment:        for the Asia Pacific region. APNIC does not operate networks
Comment:        using this IP address range and is not able to investigate
Comment:        spam or abuse reports relating to these addresses. For more
Comment:        help, refer to http://www.apnic.net/apnic-info/whois_search2/abuse-and-spamming
RegDate:        2003-02-13
Updated:        2010-07-30
Ref:            http://whois.arin.net/rest/net/NET-222-0-0-0-1

OrgName:        Asia Pacific Network Information Centre
OrgId:          APNIC
Address:        PO Box 3646
City:           South Brisbane
StateProv:      QLD
PostalCode:     4101
Country:        AU
RegDate:
Updated:        2012-01-24
Ref:            http://whois.arin.net/rest/org/APNIC

ReferralServer: whois://whois.apnic.net

OrgTechHandle: AWC12-ARIN
OrgTechName:   APNIC Whois Contact
OrgTechPhone:  +61 7 3858 3188
OrgTechEmail:  search-apnic-not-arin@apnic.net
OrgTechRef:    http://whois.arin.net/rest/poc/AWC12-ARIN

OrgAbuseHandle: AWC12-ARIN
OrgAbuseName:   APNIC Whois Contact
OrgAbusePhone:  +61 7 3858 3188
OrgAbuseEmail:  search-apnic-not-arin@apnic.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/AWC12-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

% [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

% Information related to '222.160.0.0 - 222.163.255.255'

inetnum:        222.160.0.0 - 222.163.255.255
netname:        UNICOM-JL
descr:          China Unicom Jilin province network
descr:          China Unicom
country:        CN
admin-c:        CH1302-AP
tech-c:         WT92-AP
mnt-by:         APNIC-HM
mnt-lower:      MAINT-CNCGROUP-JL
mnt-routes:     MAINT-CNCGROUP-RR
status:         ALLOCATED PORTABLE
remarks:        -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks:        This object can only be updated by APNIC hostmasters.
remarks:        To update this object, please contact APNIC
remarks:        hostmasters and include your organisation's account
remarks:        name in the subject line.
remarks:        -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
mnt-irt:        IRT-CU-CN
changed:        hm-changed@apnic.net 20050803
changed:        hm-changed@apnic.net 20060118
changed:        hm-changed@apnic.net 20090508
source:         APNIC

irt:            IRT-CU-CN
address:        No.21,Jin-Rong Street
address:        Beijing,100140
address:        P.R.China
e-mail:         zhouxm@chinaunicom.cn
abuse-mailbox:  zhouxm@chinaunicom.cn
admin-c:        CH1302-AP
tech-c:         CH1302-AP
auth:           # Filtered
mnt-by:         MAINT-CNCGROUP
changed:        zhouxm@chinaunicom.cn 20101110
changed:        hm-changed@apnic.net 20101116
source:         APNIC

person:         ChinaUnicom Hostmaster
nic-hdl:        CH1302-AP
e-mail:         abuse@cnc-noc.net
address:        No.21,Jin-Rong Street
address:        Beijing,100033
address:        P.R.China
phone:          +86-10-66259764
fax-no:         +86-10-66259764
country:        CN
changed:        abuse@cnc-noc.net 20090408
mnt-by:         MAINT-CNCGROUP
source:         APNIC

person:         Wang Tiegang
nic-hdl:        WT92-AP
e-mail:         jhli_jl@sina.cn
address:        NO.3535,Renmin Street, ChangChun ,
address:        Jilin province , 130021 , P.R. China
phone:          +86-431-5560792
fax-no:         +86-431-5560816
country:        CN
changed:        jhli_jl@mail.jl.cn 20060626
mnt-by:         MAINT-CNCGROUP-JL
changed:        hm-changed@apnic.net 20120528
source:         APNIC

% Information related to '222.160.0.0/14AS4837'

route:          222.160.0.0/14
descr:          CNC Group CHINA169 Jilin Province Network
country:        CN
origin:         AS4837
mnt-by:         MAINT-CNCGROUP-RR
changed:        abuse@cnc-noc.net 20060118
source:         APNIC

% This query was served by the APNIC Whois Service version 1.68.5 (WHOIS2)

DNSアンプ攻撃観測 (kiddy3233655.ru ANY)

よく見る形の204.46.43/24 の A レコードが大量に割り当てられている怪しいドメイン.

$ dig @127.0.0.1 kiddy3233655.ru any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.6-P1 <<>> @127.0.0.1 kiddy3233655.ru any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27105
;; flags: qr rd ra; QUERY: 1, ANSWER: 242, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;kiddy3233655.ru.		IN	ANY

;; ANSWER SECTION:
kiddy3233655.ru.	43200	IN	A	204.46.43.1
kiddy3233655.ru.	43200	IN	A	204.46.43.2
kiddy3233655.ru.	43200	IN	A	204.46.43.3
kiddy3233655.ru.	43200	IN	A	204.46.43.4
kiddy3233655.ru.	43200	IN	A	204.46.43.5
kiddy3233655.ru.	43200	IN	A	204.46.43.6
kiddy3233655.ru.	43200	IN	A	204.46.43.7
kiddy3233655.ru.	43200	IN	A	204.46.43.8
kiddy3233655.ru.	43200	IN	A	204.46.43.9
kiddy3233655.ru.	43200	IN	A	204.46.43.10
kiddy3233655.ru.	43200	IN	A	204.46.43.11
kiddy3233655.ru.	43200	IN	A	204.46.43.12
kiddy3233655.ru.	43200	IN	A	204.46.43.13
kiddy3233655.ru.	43200	IN	A	204.46.43.14
kiddy3233655.ru.	43200	IN	A	204.46.43.15
kiddy3233655.ru.	43200	IN	A	204.46.43.16
kiddy3233655.ru.	43200	IN	A	204.46.43.17
kiddy3233655.ru.	43200	IN	A	204.46.43.18
kiddy3233655.ru.	43200	IN	A	204.46.43.19
kiddy3233655.ru.	43200	IN	A	204.46.43.20
kiddy3233655.ru.	43200	IN	A	204.46.43.21
kiddy3233655.ru.	43200	IN	A	204.46.43.22
kiddy3233655.ru.	43200	IN	A	204.46.43.23
kiddy3233655.ru.	43200	IN	A	204.46.43.24
kiddy3233655.ru.	43200	IN	A	204.46.43.25
kiddy3233655.ru.	43200	IN	A	204.46.43.26
kiddy3233655.ru.	43200	IN	A	204.46.43.27
kiddy3233655.ru.	43200	IN	A	204.46.43.28
kiddy3233655.ru.	43200	IN	A	204.46.43.29
kiddy3233655.ru.	43200	IN	A	204.46.43.30
kiddy3233655.ru.	43200	IN	A	204.46.43.31
kiddy3233655.ru.	43200	IN	A	204.46.43.32
kiddy3233655.ru.	43200	IN	A	204.46.43.33
kiddy3233655.ru.	43200	IN	A	204.46.43.34
kiddy3233655.ru.	43200	IN	A	204.46.43.40
kiddy3233655.ru.	43200	IN	A	204.46.43.41
kiddy3233655.ru.	43200	IN	A	204.46.43.42
kiddy3233655.ru.	43200	IN	A	204.46.43.43
kiddy3233655.ru.	43200	IN	A	204.46.43.44
kiddy3233655.ru.	43200	IN	A	204.46.43.45
kiddy3233655.ru.	43200	IN	A	204.46.43.46
kiddy3233655.ru.	43200	IN	A	204.46.43.47
kiddy3233655.ru.	43200	IN	A	204.46.43.48
kiddy3233655.ru.	43200	IN	A	204.46.43.49
kiddy3233655.ru.	43200	IN	A	204.46.43.50
kiddy3233655.ru.	43200	IN	A	204.46.43.51
kiddy3233655.ru.	43200	IN	A	204.46.43.52
kiddy3233655.ru.	43200	IN	A	204.46.43.53
kiddy3233655.ru.	43200	IN	A	204.46.43.54
kiddy3233655.ru.	43200	IN	A	204.46.43.55
kiddy3233655.ru.	43200	IN	A	204.46.43.56
kiddy3233655.ru.	43200	IN	A	204.46.43.57
kiddy3233655.ru.	43200	IN	A	204.46.43.58
kiddy3233655.ru.	43200	IN	A	204.46.43.59
kiddy3233655.ru.	43200	IN	A	204.46.43.60
kiddy3233655.ru.	43200	IN	A	204.46.43.61
kiddy3233655.ru.	43200	IN	A	204.46.43.62
kiddy3233655.ru.	43200	IN	A	204.46.43.63
kiddy3233655.ru.	43200	IN	A	204.46.43.64
kiddy3233655.ru.	43200	IN	A	204.46.43.65
kiddy3233655.ru.	43200	IN	A	204.46.43.66
kiddy3233655.ru.	43200	IN	A	204.46.43.67
kiddy3233655.ru.	43200	IN	A	204.46.43.68
kiddy3233655.ru.	43200	IN	A	204.46.43.69
kiddy3233655.ru.	43200	IN	A	204.46.43.70
kiddy3233655.ru.	43200	IN	A	204.46.43.71
kiddy3233655.ru.	43200	IN	A	204.46.43.72
kiddy3233655.ru.	43200	IN	A	204.46.43.73
kiddy3233655.ru.	43200	IN	A	204.46.43.74
kiddy3233655.ru.	43200	IN	A	204.46.43.75
kiddy3233655.ru.	43200	IN	A	204.46.43.76
kiddy3233655.ru.	43200	IN	A	204.46.43.77
kiddy3233655.ru.	43200	IN	A	204.46.43.78
kiddy3233655.ru.	43200	IN	A	204.46.43.79
kiddy3233655.ru.	43200	IN	A	204.46.43.80
kiddy3233655.ru.	43200	IN	A	204.46.43.81
kiddy3233655.ru.	43200	IN	A	204.46.43.82
kiddy3233655.ru.	43200	IN	A	204.46.43.83
kiddy3233655.ru.	43200	IN	A	204.46.43.84
kiddy3233655.ru.	43200	IN	A	204.46.43.85
kiddy3233655.ru.	43200	IN	A	204.46.43.86
kiddy3233655.ru.	43200	IN	A	204.46.43.87
kiddy3233655.ru.	43200	IN	A	204.46.43.88
kiddy3233655.ru.	43200	IN	A	204.46.43.89
kiddy3233655.ru.	43200	IN	A	204.46.43.90
kiddy3233655.ru.	43200	IN	A	204.46.43.91
kiddy3233655.ru.	43200	IN	A	204.46.43.92
kiddy3233655.ru.	43200	IN	A	204.46.43.93
kiddy3233655.ru.	43200	IN	A	204.46.43.94
kiddy3233655.ru.	43200	IN	A	204.46.43.95
kiddy3233655.ru.	43200	IN	A	204.46.43.96
kiddy3233655.ru.	43200	IN	A	204.46.43.97
kiddy3233655.ru.	43200	IN	A	204.46.43.98
kiddy3233655.ru.	43200	IN	A	204.46.43.99
kiddy3233655.ru.	43200	IN	A	204.46.43.100
kiddy3233655.ru.	43200	IN	A	204.46.43.101
kiddy3233655.ru.	43200	IN	A	204.46.43.102
kiddy3233655.ru.	43200	IN	A	204.46.43.103
kiddy3233655.ru.	43200	IN	A	204.46.43.104
kiddy3233655.ru.	43200	IN	A	204.46.43.105
kiddy3233655.ru.	43200	IN	A	204.46.43.106
kiddy3233655.ru.	43200	IN	A	204.46.43.107
kiddy3233655.ru.	43200	IN	A	204.46.43.108
kiddy3233655.ru.	43200	IN	A	204.46.43.109
kiddy3233655.ru.	43200	IN	A	204.46.43.110
kiddy3233655.ru.	43200	IN	A	204.46.43.111
kiddy3233655.ru.	43200	IN	A	204.46.43.112
kiddy3233655.ru.	43200	IN	A	204.46.43.113
kiddy3233655.ru.	43200	IN	A	204.46.43.114
kiddy3233655.ru.	43200	IN	A	204.46.43.115
kiddy3233655.ru.	43200	IN	A	204.46.43.116
kiddy3233655.ru.	43200	IN	A	204.46.43.117
kiddy3233655.ru.	43200	IN	A	204.46.43.118
kiddy3233655.ru.	43200	IN	A	204.46.43.119
kiddy3233655.ru.	43200	IN	A	204.46.43.120
kiddy3233655.ru.	43200	IN	A	204.46.43.121
kiddy3233655.ru.	43200	IN	A	204.46.43.122
kiddy3233655.ru.	43200	IN	A	204.46.43.123
kiddy3233655.ru.	43200	IN	A	204.46.43.124
kiddy3233655.ru.	43200	IN	A	204.46.43.125
kiddy3233655.ru.	43200	IN	A	204.46.43.126
kiddy3233655.ru.	43200	IN	A	204.46.43.127
kiddy3233655.ru.	43200	IN	A	204.46.43.128
kiddy3233655.ru.	43200	IN	A	204.46.43.129
kiddy3233655.ru.	43200	IN	A	204.46.43.130
kiddy3233655.ru.	43200	IN	A	204.46.43.131
kiddy3233655.ru.	43200	IN	A	204.46.43.132
kiddy3233655.ru.	43200	IN	A	204.46.43.133
kiddy3233655.ru.	43200	IN	A	204.46.43.134
kiddy3233655.ru.	43200	IN	A	204.46.43.135
kiddy3233655.ru.	43200	IN	A	204.46.43.136
kiddy3233655.ru.	43200	IN	A	204.46.43.137
kiddy3233655.ru.	43200	IN	A	204.46.43.138
kiddy3233655.ru.	43200	IN	A	204.46.43.139
kiddy3233655.ru.	43200	IN	A	204.46.43.140
kiddy3233655.ru.	43200	IN	A	204.46.43.141
kiddy3233655.ru.	43200	IN	A	204.46.43.142
kiddy3233655.ru.	43200	IN	A	204.46.43.143
kiddy3233655.ru.	43200	IN	A	204.46.43.144
kiddy3233655.ru.	43200	IN	A	204.46.43.145
kiddy3233655.ru.	43200	IN	A	204.46.43.146
kiddy3233655.ru.	43200	IN	A	204.46.43.147
kiddy3233655.ru.	43200	IN	A	204.46.43.148
kiddy3233655.ru.	43200	IN	A	204.46.43.149
kiddy3233655.ru.	43200	IN	A	204.46.43.150
kiddy3233655.ru.	43200	IN	A	204.46.43.151
kiddy3233655.ru.	43200	IN	A	204.46.43.152
kiddy3233655.ru.	43200	IN	A	204.46.43.153
kiddy3233655.ru.	43200	IN	A	204.46.43.154
kiddy3233655.ru.	43200	IN	A	204.46.43.155
kiddy3233655.ru.	43200	IN	A	204.46.43.156
kiddy3233655.ru.	43200	IN	A	204.46.43.157
kiddy3233655.ru.	43200	IN	A	204.46.43.158
kiddy3233655.ru.	43200	IN	A	204.46.43.159
kiddy3233655.ru.	43200	IN	A	204.46.43.160
kiddy3233655.ru.	43200	IN	A	204.46.43.161
kiddy3233655.ru.	43200	IN	A	204.46.43.162
kiddy3233655.ru.	43200	IN	A	204.46.43.163
kiddy3233655.ru.	43200	IN	A	204.46.43.164
kiddy3233655.ru.	43200	IN	A	204.46.43.165
kiddy3233655.ru.	43200	IN	A	204.46.43.166
kiddy3233655.ru.	43200	IN	A	204.46.43.167
kiddy3233655.ru.	43200	IN	A	204.46.43.168
kiddy3233655.ru.	43200	IN	A	204.46.43.169
kiddy3233655.ru.	43200	IN	A	204.46.43.170
kiddy3233655.ru.	43200	IN	A	204.46.43.171
kiddy3233655.ru.	43200	IN	A	204.46.43.172
kiddy3233655.ru.	43200	IN	A	204.46.43.173
kiddy3233655.ru.	43200	IN	A	204.46.43.174
kiddy3233655.ru.	43200	IN	A	204.46.43.175
kiddy3233655.ru.	43200	IN	A	204.46.43.176
kiddy3233655.ru.	43200	IN	A	204.46.43.177
kiddy3233655.ru.	43200	IN	A	204.46.43.178
kiddy3233655.ru.	43200	IN	A	204.46.43.179
kiddy3233655.ru.	43200	IN	A	204.46.43.180
kiddy3233655.ru.	43200	IN	A	204.46.43.181
kiddy3233655.ru.	43200	IN	A	204.46.43.182
kiddy3233655.ru.	43200	IN	A	204.46.43.183
kiddy3233655.ru.	43200	IN	A	204.46.43.184
kiddy3233655.ru.	43200	IN	A	204.46.43.185
kiddy3233655.ru.	43200	IN	A	204.46.43.186
kiddy3233655.ru.	43200	IN	A	204.46.43.187
kiddy3233655.ru.	43200	IN	A	204.46.43.188
kiddy3233655.ru.	43200	IN	A	204.46.43.189
kiddy3233655.ru.	43200	IN	A	204.46.43.190
kiddy3233655.ru.	43200	IN	A	204.46.43.191
kiddy3233655.ru.	43200	IN	A	204.46.43.192
kiddy3233655.ru.	43200	IN	A	204.46.43.193
kiddy3233655.ru.	43200	IN	A	204.46.43.194
kiddy3233655.ru.	43200	IN	A	204.46.43.195
kiddy3233655.ru.	43200	IN	A	204.46.43.196
kiddy3233655.ru.	43200	IN	A	204.46.43.197
kiddy3233655.ru.	43200	IN	A	204.46.43.198
kiddy3233655.ru.	43200	IN	A	204.46.43.199
kiddy3233655.ru.	43200	IN	A	204.46.43.200
kiddy3233655.ru.	43200	IN	A	204.46.43.201
kiddy3233655.ru.	43200	IN	A	204.46.43.202
kiddy3233655.ru.	43200	IN	A	204.46.43.203
kiddy3233655.ru.	43200	IN	A	204.46.43.204
kiddy3233655.ru.	43200	IN	A	204.46.43.205
kiddy3233655.ru.	43200	IN	A	204.46.43.206
kiddy3233655.ru.	43200	IN	A	204.46.43.207
kiddy3233655.ru.	43200	IN	A	204.46.43.208
kiddy3233655.ru.	43200	IN	A	204.46.43.209
kiddy3233655.ru.	43200	IN	A	204.46.43.210
kiddy3233655.ru.	43200	IN	A	204.46.43.211
kiddy3233655.ru.	43200	IN	A	204.46.43.212
kiddy3233655.ru.	43200	IN	A	204.46.43.213
kiddy3233655.ru.	43200	IN	A	204.46.43.214
kiddy3233655.ru.	43200	IN	A	204.46.43.215
kiddy3233655.ru.	43200	IN	A	204.46.43.216
kiddy3233655.ru.	43200	IN	A	204.46.43.217
kiddy3233655.ru.	43200	IN	A	204.46.43.218
kiddy3233655.ru.	43200	IN	A	204.46.43.219
kiddy3233655.ru.	43200	IN	A	204.46.43.220
kiddy3233655.ru.	43200	IN	A	204.46.43.221
kiddy3233655.ru.	43200	IN	A	204.46.43.222
kiddy3233655.ru.	43200	IN	A	204.46.43.223
kiddy3233655.ru.	43200	IN	A	204.46.43.224
kiddy3233655.ru.	43200	IN	A	204.46.43.225
kiddy3233655.ru.	43200	IN	A	204.46.43.226
kiddy3233655.ru.	43200	IN	A	204.46.43.227
kiddy3233655.ru.	43200	IN	A	204.46.43.228
kiddy3233655.ru.	43200	IN	A	204.46.43.229
kiddy3233655.ru.	43200	IN	A	204.46.43.230
kiddy3233655.ru.	43200	IN	A	204.46.43.231
kiddy3233655.ru.	43200	IN	A	204.46.43.232
kiddy3233655.ru.	43200	IN	A	204.46.43.233
kiddy3233655.ru.	43200	IN	A	204.46.43.234
kiddy3233655.ru.	43200	IN	A	204.46.43.235
kiddy3233655.ru.	43200	IN	A	204.46.43.236
kiddy3233655.ru.	43200	IN	A	204.46.43.237
kiddy3233655.ru.	43200	IN	A	204.46.43.238
kiddy3233655.ru.	43200	IN	A	204.46.43.239
kiddy3233655.ru.	43200	IN	A	204.46.43.240
kiddy3233655.ru.	43200	IN	A	204.46.43.241
kiddy3233655.ru.	43200	IN	A	204.46.43.242
kiddy3233655.ru.	43200	IN	A	204.46.43.243
kiddy3233655.ru.	43200	IN	A	204.46.43.244
kiddy3233655.ru.	43200	IN	NS	ns1.reg.ru.
kiddy3233655.ru.	43200	IN	NS	ns2.reg.ru.
kiddy3233655.ru.	43200	IN	SOA	ns1.reg.ru. hostmaster.ns1.reg.ru. 1378751646 14400 3600 604800 21600

;; Query time: 12 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Oct  7 14:00:51 2013
;; MSG SIZE  rcvd: 3944
$ whois 31.31.204.25

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 31.31.204.25"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=31.31.204.25?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       31.0.0.0 - 31.255.255.255
CIDR:           31.0.0.0/8
OriginAS:
NetName:        RIPE-31
NetHandle:      NET-31-0-0-0-1
Parent:
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
RegDate:
Updated:        2010-05-18
Ref:            http://whois.arin.net/rest/net/NET-31-0-0-0-1

OrgName:        RIPE Network Coordination Centre
OrgId:          RIPE
Address:        P.O. Box 10096
City:           Amsterdam
StateProv:
PostalCode:     1001EB
Country:        NL
RegDate:
Updated:        2013-07-29
Ref:            http://whois.arin.net/rest/org/RIPE

ReferralServer: whois://whois.ripe.net:43

OrgTechHandle: RNO29-ARIN
OrgTechName:   RIPE NCC Operations
OrgTechPhone:  +31 20 535 4444
OrgTechEmail:  hostmaster@ripe.net
OrgTechRef:    http://whois.arin.net/rest/poc/RNO29-ARIN

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName:   Abuse Contact
OrgAbusePhone:  +31205354444
OrgAbuseEmail:  abuse@ripe.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE3850-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '31.31.204.0 - 31.31.205.255'

% Abuse contact for '31.31.204.0 - 31.31.205.255' is 'abuse@reg.ru'

inetnum:        31.31.204.0 - 31.31.205.255
netname:        REGRU-NETWORK
descr:          Reg.Ru
country:        RU
admin-c:        RGRU-RIPE
tech-c:         RGRU-RIPE
status:         ASSIGNED  PA
mnt-by:         REGRU-MNT
mnt-routes:     DN-MNT
remarks:        INFRA-AW
source:         RIPE # Filtered

role:           Reg.Ru Network Operations
address:        Russia, Moscow, Vassily Petushkova st., house 3, Office 326
remarks:        NOC e-mail: noc@reg.ru
remarks:        User support: support@reg.ru
remarks:        SPAM reports: abuse@reg.ru
phone:          +7 (495) 580-11-11
fax-no:         +7 (495) 491-55-53
admin-c:        ARP-RIPE
tech-c:         ARP-RIPE
nic-hdl:        RGRU-RIPE
mnt-by:         REGRU-MNT
abuse-mailbox:  abuse@reg.ru
source:         RIPE # Filtered

% Information related to '31.31.204.0/24AS12695'

route:          31.31.204.0/24
descr:          Reg.Ru
origin:         AS12695
mnt-by:         DN-MNT
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.69 (WHOIS4)

DNSアンプ攻撃観測 (1x1.cz ANY)

DNSSEC関係で凄いことになっている.チェコの会社っぽい.

$ dig @::1 1x1.cz any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.6-P1 <<>> @::1 1x1.cz any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33384
;; flags: qr rd ra; QUERY: 1, ANSWER: 26, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;1x1.cz.				IN	ANY

;; ANSWER SECTION:
1x1.cz.			1800	IN	SOA	ns.gransy.com. root.gransy.com. 2013092009 86400 900 1209600 1800
1x1.cz.			1800	IN	RRSIG	SOA 7 2 1800 20140920002332 20130920002332 56890 1x1.cz. VoueicIrPDYlgmp+Ty+/5A6OjqI6Nen7GV1L2Cac5W7MeIeARaiCZL1N ggBPAwgfh1Q543kj8uJcnjtbYmgd6Px08sFW4wb3oSz1gu3M2b4Iq7AZ xERqzAXrRMQI1IZ8zkXaLHCGllmDfn67GuEKNeD6Ggir8Mdx8H5QaMme /R/M7PAxJVjEr1wyrLQm9HwbPQwya5+b9XfLO85+Q9KwzgIbQVbWc3aN PA5aitnKP+E45dnUVL1EGL5+zF+5oW1DBYp1bSanCbueXxDmrCl5A8lq LFQC657TbtN7t7AHnbFEzVsad0oH28dP16nHWNOsL+XZm5aJbupZs4om uoygcb/hkXfShAlErWE9ubnQIa3d0FtoiCNjyW93HIxvhIEeUR/6+a07 Ye4ob2ifsnLSECLoGm3vtv8tc19RQyAg/pvCsNHaCUfKd9H1vF7pjRtU 2Q2k5EoOyIkrw6aRoEn79GoLhyjUtDc4eegcx8KEkfkydITr5iOa7xJi Z4xRQUzGVzARHCtvc2Njj5gWw/p8XkX1roD4dHyMZRc5jIWH890UcN+k z5VwL4h8X0wAgbnyVninqYHSWVB6RSFJofmvpPQBHs7NkSiy4o88VWM0 mGj2FUj8+QznVsMV789z6hr6iaelAxDhmQ2I6RV47dEma1E+wydfCViM Z6+OuVtb/bQ=
1x1.cz.			1800	IN	DNSKEY	256 3 7 BQEAAAAB9QdSKCeptWzBV1tlAFU+AaiSGgU7XaUY6YHgtUQ1ggPvJApl v3N9Xt8vB+z7/FThK4gxzQ3xZ+Y0xZ0sEnQVdl05XTfrrOGjwr6x3Pwx wepWONVZ6FXDb+LhEFx95kYOIjhLnyr5UvOHu9vFOEu1mMENo9gdg00D MBX+tXNBxiHIXzsFUE90QmXBro2GH4EHqTX+4ZVuNCOFhzAnp3h+O7SQ TR8npmdRrmWJvC42uT6ODGEFOnstZ+vJDQnc3ZLvzJvuaXK9pUGJmIQ7 5MEs9xcngf7JXRmW/FqsTph0ZcAXUoad8+Tu43Z0+V1Znf7WtCfODqqj KsKklt7CdY7R6NzEV9b5F//rvG88wZeg+PKXNVbQFFSzyguEsFrvjrTT hdKjyDPfbMRl/vMeoB/dfnB1VP5Ds1zMpqqYqiPPVLBmCjuRC2EalK3t Ph3y9U2xE+A2vytXETew+T+nX9ZG62rS7YnKwsMYrSzUPDTXYgCVwsDM /2Ecl5XEpemOnTvMmQGh7LUuYs/kK2hImPew5ntAQC6jnGr37xC3xtBf kFQN4sV5iSOvZWs5mjP2iEhGEFl5fRqU0Zvck0vOCHBBU0oRj8k4VUpU KSFe2W4iKolj2VS9Jr7S5WIFGFMHUfhyC1j5FVAqSyLBnEKOWper3O+d MQrtWTRl5L1H7v96O/E=
1x1.cz.			1800	IN	DNSKEY	257 3 7 BQEAAAABw0H2Xb7JjIuMMVRD3oqWpoXsriUK4sCT2B0TAc9b6v7K+gEI fhtrQ+LImQ/yY4VLZ1z88RDe48LvV2kA3fjB+4tFJTsgmgxCAg29skRN orVLnb6ztSqZO3FuTYgH3yywEw3W4rTkPfthNhiaMEVXVrFDDU4dGhiJ mvIa9mkaPOkIKeRV4gJqs2YSEIhCKeMxkNNGLn1CIXAiFjVbVDcYFv0n 1bBY2iDUllDIRZapMfoSwJMnHI6VXz3CGjxIfcFcr+BUfVFhobqyV848 n4HJcHKMgErtC8xFmRD++Pq/isLbNs48zDSZQY5jJvD30anwzZnzhWJJ 2ZlirUm6pIazB3a6A7V3c381TsRAyY8suy5pkEriSVs4wSfHkiiwd3Z1 sHCTHgefwyRrArFycXR4bvz9sSFOCjbZfJ4S2RFchQa2D+IJsea+kXa+ LGOi2enMd6Jaq5+WB6dUkgWz+9a0/xqCC2ShywyWeazuoLaaejL8NUDf sGj4TEHfkXX+/BodFl6SicWsQEZuNU44/+pyyFqgDKsHu9t8mDtz/IGR Z/Duj9GKTQ4j953Czkic0thvFwqqd6Xm+C48K1qIB1vWqV4AinXDVf/q jbkPxGP01P+riUs5E0zTEoJOtyTtm/xoV5lTwe2PvhysrtGmcTdyqZXD Z6DQnUgkO7BUjlprbnk=
1x1.cz.			1800	IN	RRSIG	DNSKEY 7 2 1800 20140920002332 20130920002332 52247 1x1.cz. I0sVnwyHKBl5dVGYkpgxcWCVT1uEn6Rzp2rREqwLMQnyIvdGIgWzckRa 8x75SdLW1Giszb1jQyfGRhq0MdVN6Q6YnJfOHTyOaD+H40EDH1rHni8K JqZlg+pgkJdqbMD+Updl6AIfuuhurVTi4o+VWGLr49M6avqtRw1xpxGn zY2xw9r+6UqECGGKNbEOOj5jMv/tSJ3iXKyDqMR9yyE4BlbvcurVe5zH pgZf2wuxakdmOaOrXhxszVQlsnuBdr83ZijMw6uYIt/y3eByT5q7Lkmv fenfRnif5rNXlksP+UE0WAN0CCJ7+OfM3TzS7NF/7sFyWqgWQKRsTcZO l7c7nInWR/W4k7go8J6RFR3sCUPL4p4045TFzpi72EHe/sE8qtI5zHpf FNyu5HOCLMIPTWaPbxSMivdWh1x78wELyEbG7aplFW8/iwdXV5bWpGFP tTBg16u6kIbXiCMQYXYJpDtvaT3qlqDwD25NNSXp9Sgf7jx8ZXY1k3yu zw0XU+5Gxnl4UxDS/z8dicrrBuuWpBCw5hsaueFmkMNIHZ8R6/32sJ4I 1q/DEv8c0lli/y8S3pAQF9pFdtBH1145R8oERxqxr1dsOhSCJPrGoFVT MyhMG2481Osx5CgyjA2wQyW6Y3NNoM1i4MAjT1WMwgxxbhrM+CAQZpx6 P09zD5W83e0=
1x1.cz.			1800	IN	RRSIG	DNSKEY 7 2 1800 20140920002332 20130920002332 56890 1x1.cz. P2OcDuLKhOuhkYHp9cCqmHKtJKWXu4OY7CapquNk7SFIraEITJWuqgmU d4rtnsEkwbxx6VxhveWBVWpa4YXHS7afoTW64UgBw0YRyb0hiYSLeBYv AYfp0oG0L0pK9W93QiVoPGAVwgqJ8zD4UnCYaHtVeyeE522hB0H9o3Lk pB2U4xp9H/Gt7n5MVHDqk100wPVwiq7kkIeFkXfEWQpLff+R94ZJHpfr GrFdQy2LDHlzAszzJVsDgfQBMvFTWuy2zBVENLbn03Z57XXdbWjRRjso VWJwjyqZ9tfqg0D/52uAmrSVgU9/6ZhOOdSP6A1ziOJyVpxyGxPYH3SN rX1vbcbuXuNy6SCtnrsQh9KTIfEuEswRnOntdi7ApuF2oSOJXtsDAmYl KuLIwDEQvFrgAhO8ahTFBkU5m3jW5+t3C7pPr0m35gLCSHrkxDRz7BkL r6ILDE2OpJbFbN84imHrP6upCGBUyaCzUHUoUTHLD+TYYk86fiTgVSqt h/13+Zw/dAmmsyMIsPsKo7+KP40p9K0sP9ddJKeZU0v9InS3wCgnRcQt 5ZsNCW3x+yOJFPgSqbSxkiBwBFdnnUWq1EZNAAhFYPPLiLN2YX1eiAEA Zea/xJHJ9j0DIfa7vj+ZVb/XW24VrWjrREq2PQ2OjQuiSQxiJbd0c9tj L9fuopW1oeE=
1x1.cz.			1800	IN	NSEC	*.1x1.cz. A NS SOA MX TXT RRSIG NSEC DNSKEY
1x1.cz.			1800	IN	RRSIG	NSEC 7 2 1800 20140920002332 20130920002332 56890 1x1.cz. VQJz2B5G/2AlH8X4k4dwI4j1zMaherEmcBemAgOO7UNDzLyRhonN1Vxc bX9BfQXs8/pA8TQtrf02E3J9z/xk1EzAK+4bc2m4q2Y51cxXO9T7nmSz lFsK0p+mNb3eyPvZgN7jtW/AG8NSBxE7RnxiOinhyfci8KhiFOXNqigJ 3/7LAFy3PpO7/sOQr1SZ676XOD5y420AsBge6oMCGJnDqTm8W3QTcqaK LYJaPiw+NVE7sfNuFmFSG+RzjZQagSTF40CVGMevzgMPH1lYI2/pFyXP S4dxurrmNMgQT/2ck4JLymzhDUpckmVsn9wv8lBkpT18SUpv7UGj5b6n VMQPJZPcnIBjjBXfOgv90zLTRXKmKbdn4jNJRKTIuq9ZFFgVtOcG5D3O XPCrMwiCQOwGO0jYWAYmvt/QoviyCmATgd3frnCE77yW8g4T03c7C29N e2GW7z+ZxcQKNW2xWe16c/JNJh2syqFBeMUCkRWBW+/tsFRk4mJ0j3OU 44U2QNbTqqUs+VLA0VQ7KqCAKGdmtASCNqvd6nnWbmzmrIUYut2YkKGO x5WYTjdngWUXzSflbrg4R01fbgwiA4pz8uAs7gh3WcE5BiV9rO4t/Drr CIB6vVBDTJwuu2PYU25CCMW47MZqm/twRsF/zbuc/16X/FTtbn0S8B87 Kex9kLo/8Is=
1x1.cz.			1800	IN	TXT	"v=spf1 include:_spf.google.com ~all"
1x1.cz.			1800	IN	RRSIG	TXT 7 2 1800 20140920002332 20130920002332 56890 1x1.cz. mhd4YNHg1Me/Ay40kuElKBjfq1rxg51lPpQJyv5vISZi9ICKC13WfSjv 6CCOnoxPNjqEHxv/+xALlhzmiXnv6JjI4k4BEVMdLApL3w+ZjMXLEqyv D5+Yi4o5OKgdpGlTcrNE983P0/ibgEu+CewsN6YN2/ha014XBtKJrhoF 7t+yRa+KXXX9xIjDPAXjRjL+GkkAL2J2Gt76fs2mzZyJCEG+JLYi/mW9 8dR2wOn/1GsSUgP+j0DGfPoq+MhXAbUGPltyYRpYaliPj0np8FDFBe2+ wTovhpENYayin6R5TyuRE2QvNx2DV3tiUJRiTTcgML9dZJ0sdzLmwwc1 1dBPt0FYvSQ7hLaXtrNwG6HZhbOPHZlz8Cd1phCjOdkya1zhqslMboeJ mjw7YhnbDXkjZf4mw/8km2TWuXUYv5Ujern261JBdbeiI7ce4iumb8Ra jE8jsHWsKnEVlovwI2tPvo82/AGFZFBxagz0ayPL4TQQbHm7vbR9Kv5c h9XX3f0mKP5Jr25Az8OdW1zC9ss2PHQYTinbcYjFZyvPQGRFUo5EhfbB fpolBalqTYrmVOsvrJ5nlTTSUAJYukVkRIU/W8hEhSyAQX2zY7U4kf/f o3skWAfJnN5m13GCOu6uoyJ4JNicR3+NdP2aAW1cujuSu9Wxgc2bxjSG MAFabIX/s54=
1x1.cz.			1800	IN	MX	30 ASPMX2.GOOGLEMAIL.com.
1x1.cz.			1800	IN	MX	30 ASPMX3.GOOGLEMAIL.com.
1x1.cz.			1800	IN	MX	30 ASPMX4.GOOGLEMAIL.com.
1x1.cz.			1800	IN	MX	30 ASPMX5.GOOGLEMAIL.com.
1x1.cz.			1800	IN	MX	10 ASPMX.L.GOOGLE.com.
1x1.cz.			1800	IN	MX	20 ALT1.ASPMX.L.GOOGLE.com.
1x1.cz.			1800	IN	MX	20 ALT2.ASPMX.L.GOOGLE.com.
1x1.cz.			1800	IN	RRSIG	MX 7 2 1800 20140920002332 20130920002332 56890 1x1.cz. VaMmj4xK5S6/DgFxRM8gvbFkgB38mwkhhC4o4RCzZPjELBq5m2mFypUj yynXsFb+OBTaDz3oOaedTN59pMg9da7SwlrOxEsIPfqq9I1jzlMwDMKx /LxUqbyCI10tKFFZM4Euq5R//qXLRfNE/fNHuQzqKVLU+/LUC3cEzF9R RaGGJFf688nRtuUXF6v2vNtGPWt2K9ucC+lk+Wi27gI7zOrnZJ9N8LBe Md4ghd3ayY+MK4HgdH1pqtoe1kzpahnUvQVlLv7EHlNSpNMgqdpyBS/F j+icO22XfjSAjw8rx/RpfcOW1x6YUolXLWQAo4IWsvq9V5Ggj/YD18W1 crf3nlAuYmx3sAmBvAa+Ov58JT8Wxo0AevaQYoMlxthMccKSSFHpJJE2 yuFuFuU2I4IzmmVppXxDd4M/Y44L67eq1ACvU7NUgcx85TpEabWNneBN 59AgD9f8j+hQtxkilpDrqJbVMjS2nVPnBrtMtzJNzFPfGu0Bj8j5TVFN Wz90hcS2m7ngnvMPL1cwqIn9scynpzmdnZEbCVPhW7rMGrGz1UmiDEyv /P3e/T1mHgv4gSmLKINLD1sA+PbjtrOA8xdzMRG4yVuzX/vTTeQh98re Ng3+8jK/nn9t/0o+nIAAOdssGIdPLW1HXBGuPnfpdIhl//6KV1vQU5JR 8ZoYHkyJld8=
1x1.cz.			1800	IN	A	46.234.99.18
1x1.cz.			1800	IN	RRSIG	A 7 2 1800 20140920002332 20130920002332 56890 1x1.cz. KH6DnSGdTX+dUCf6hLrha6KmvSTVVf5gkVhp9a7xd0gdyBgTFoRRKWQt 6wEXtDoEAmeDnkZo7GPuvQO9jzYGmqZLZNvsYHhVs15d7fhYjFaOZTjZ exn7LwxC7zAALrmp95u5OLzs8qHbz6idOzU+v7UXeZG77YDYpyip0moz q0ZM65WK5pOhQPm10wTfaCcUNrObh97urYQnA8vQyg4kohKg0FqlXXKG bM8NR2aDUMKasPrs2TGWustbkjg+JqLsB+gam1RoDxiI4bw+QaQFgdwC fbKholt/aFUHeaHgtYI6GSbTNeKeXCa3Tw/XRWF17PQ+xekBbDAyGqJs rmnpk6avXS1PpCPPoXOV+Gd9TObwkDvUY+f8IrOrbS3uNxmyNWcZkjDi 3CLICTgVIARyH3bzCZLERPUUxtBZstU90oQ+VsxwCX/fQReCKahaxFz/ ljvtP7tRiro1rma0d/DcJ9yWsVv/Js98n2QcIqGDoGPMBr18eqhW0sON 3IodJ4LphH0ADMgHtpVokE03gWAM6T7oZd31YrmhjkSGlxnKjDsJ6u2Z 6FEnJBD4qXK208RQVQx9w8MwcSLKVxYmDxIVf5XinYQ6oK5B7N6V1Fs6 0DoIoz4zMBt9s2iprQUoLCGaDbBLMg8KM+5s6Gc0oi/GxxMO87POKUjJ 16pYbx9PNVo=
1x1.cz.			1800	IN	NS	ns3.gransy.com.
1x1.cz.			1800	IN	NS	ns5.gransy.com.
1x1.cz.			1800	IN	NS	ns4.gransy.com.
1x1.cz.			1800	IN	NS	ns2.gransy.com.
1x1.cz.			1800	IN	NS	ns.gransy.com.
1x1.cz.			1800	IN	RRSIG	NS 7 2 1800 20140920002332 20130920002332 56890 1x1.cz. 459V0KYCr/59wvjKJivwX2gBxlkSuLJNas8V1CL0cxeVlayOlSLDruJ7 UTaIrHDl8XZzixBsyqYrgMt+x72WKCyvrFUebSYF0bH0liBpmgRZfuDB 6EbCN4/qntTVqydKarxBBNvPWrGvpNcqUejgKBzl8LaH0Zvo64jBmrsL gp8vjP9hW0n0zGUtjdrumOroEzqvGL4JtJhBDqhv1on51szR7bF2QZhC 301eDrG66aH7b9TN5vrN5rODh+jsJ0hbMu1L9yC+TUmBr3ffFyME6zvE VtbBgoEJQakOoT7TNmU8zA1eDOVFJce5ul/mRhf1jPshYhYAQPQ0e6rG Xbg/IIdJO7AhxtiKLS9H2NrJ+CKlOev5Rhub2LWyLgUJmPErzYgU7CQq INMPhnVbQ0SSHypkQbnJmpLZ8kkgh0UFAdzVAfSqOnmfX4lkH5czOUYB ag6j9cPSU9VdOvTNV3I3U10LmbpTAVljy4vMBVfshb1ALCzOFPbOPrYx Quv//MbMvGmQZZElVBM+pAczWDjmOsW80kedIo1nkKidUbR/ZdT8eB70 s7lPPyHRqJ8O+hQNSvwjILiO/nuoz8GOFafgLFPWNnqvXmDT6EuC6gRK f2llLfngCorQpf8u5xTHT9bg35xmuBUntZovzYQC3IzW3BM5BcVWfPeV gkfUasjsbto=

;; Query time: 4 msec
;; SERVER: ::1#53(::1)
;; WHEN: Mon Oct  7 13:13:29 2013
;; MSG SIZE  rcvd: 5903
$ whois 46.234.99.18

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 46.234.99.18"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=46.234.99.18?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       46.0.0.0 - 46.255.255.255
CIDR:           46.0.0.0/8
OriginAS:
NetName:        46-RIPE
NetHandle:      NET-46-0-0-0-0
Parent:
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
RegDate:        2009-09-29
Updated:        2009-09-30
Ref:            http://whois.arin.net/rest/net/NET-46-0-0-0-0

OrgName:        RIPE Network Coordination Centre
OrgId:          RIPE
Address:        P.O. Box 10096
City:           Amsterdam
StateProv:
PostalCode:     1001EB
Country:        NL
RegDate:
Updated:        2013-07-29
Ref:            http://whois.arin.net/rest/org/RIPE

ReferralServer: whois://whois.ripe.net:43

OrgTechHandle: RNO29-ARIN
OrgTechName:   RIPE NCC Operations
OrgTechPhone:  +31 20 535 4444
OrgTechEmail:  hostmaster@ripe.net
OrgTechRef:    http://whois.arin.net/rest/poc/RNO29-ARIN

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName:   Abuse Contact
OrgAbusePhone:  +31205354444
OrgAbuseEmail:  abuse@ripe.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE3850-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '46.234.96.0 - 46.234.127.255'

inetnum:        46.234.96.0 - 46.234.127.255
netname:        CZ-SUPERNETWORK-20110210
descr:          SuperNetwork s.r.o.
country:        CZ
org:            ORG-SS59-RIPE
admin-c:        ZC10-RIPE
tech-c:         ZC10-RIPE
tech-c:         DC1000-RIPE
tech-c:         JP4750-RIPE
status:         ALLOCATED PA
mnt-by:         RIPE-NCC-HM-MNT
mnt-lower:      SUPERNETWORK-MNT
mnt-routes:     SUPERNETWORK-MNT
mnt-domains:    SUPERNETWORK-MNT
source:         RIPE # Filtered

organisation:   ORG-Ss59-RIPE
org-name:       SuperNetwork s.r.o.
org-type:       LIR
address:        SuperNetwork s.r.o.
                Zdenek Cendra
                Bilejova 407
                46303 Liberec
                CZECH REPUBLIC
phone:          +420296826296
fax-no:         +420482731466
admin-c:        DC1000-RIPE
admin-c:        ZC10-RIPE
admin-c:        JP4750-RIPE
mnt-ref:        SUPERNETWORK-MNT
mnt-ref:        RIPE-NCC-HM-MNT
mnt-by:         RIPE-NCC-HM-MNT
source:         RIPE # Filtered

person:         David Cermak
address:        PRO-ZETA a.s.
address:        Tiskarska 10/257
address:        108 00 Praha 10
address:        Czech Republic
phone:          +420222742702
nic-hdl:        DC1000-RIPE
mnt-by:         SUPERNETWORK-MNT
source:         RIPE # Filtered

person:         Jiri Prochazka
address:        SuperNetwork s.r.o.
address:        Na Safrance 33
address:        Prague 10
address:        101 00
address:        Czech Republic
phone:          +420296826296
nic-hdl:        JP4750-RIPE
mnt-by:         supernetwork-mnt
source:         RIPE # Filtered

person:         Zdenek Cendra
address:        Na Safrance 33
address:        Praha 10
address:        101 00
address:        Czech Republic
phone:          +420296826296
nic-hdl:        ZC10-RIPE
mnt-by:         SUPERNETWORK-MNT
source:         RIPE # Filtered

% Information related to '46.234.96.0/20AS39392'

route:          46.234.96.0/20
descr:          SuperNetwork s.r.o.
origin:         AS39392
mnt-by:         SUPERNETWORK-MNT
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.69 (WHOIS1)

DNSアンプ攻撃観測 (irlwinning.com ANY)

irlwinning.com も数日引けなかったけれど,復活している.

$ dig @::1 irlwinning.com any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.6-P1 <<>> @::1 irlwinning.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38409
;; flags: qr rd ra; QUERY: 1, ANSWER: 244, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;irlwinning.com.			IN	ANY

;; ANSWER SECTION:
irlwinning.com.		20371	IN	NS	ns1.irlwinning.com.
irlwinning.com.		20371	IN	NS	ns2.irlwinning.com.
irlwinning.com.		21600	IN	A	1.1.1.147
irlwinning.com.		21600	IN	A	1.1.1.148
irlwinning.com.		21600	IN	A	1.1.1.149
irlwinning.com.		21600	IN	A	1.1.1.150
irlwinning.com.		21600	IN	A	1.1.1.151
irlwinning.com.		21600	IN	A	1.1.1.152
irlwinning.com.		21600	IN	A	1.1.1.153
irlwinning.com.		21600	IN	A	1.1.1.154
irlwinning.com.		21600	IN	A	1.1.1.155
irlwinning.com.		21600	IN	A	1.1.1.156
irlwinning.com.		21600	IN	A	1.1.1.157
irlwinning.com.		21600	IN	A	1.1.1.158
irlwinning.com.		21600	IN	A	1.1.1.159
irlwinning.com.		21600	IN	A	1.1.1.160
irlwinning.com.		21600	IN	A	1.1.1.161
irlwinning.com.		21600	IN	A	1.1.1.162
irlwinning.com.		21600	IN	A	1.1.1.163
irlwinning.com.		21600	IN	A	1.1.1.164
irlwinning.com.		21600	IN	A	1.1.1.165
irlwinning.com.		21600	IN	A	1.1.1.166
irlwinning.com.		21600	IN	A	1.1.1.167
irlwinning.com.		21600	IN	A	1.1.1.168
irlwinning.com.		21600	IN	A	1.1.1.169
irlwinning.com.		21600	IN	A	1.1.1.170
irlwinning.com.		21600	IN	A	1.1.1.171
irlwinning.com.		21600	IN	A	1.1.1.172
irlwinning.com.		21600	IN	A	1.1.1.173
irlwinning.com.		21600	IN	A	1.1.1.174
irlwinning.com.		21600	IN	A	1.1.1.175
irlwinning.com.		21600	IN	A	1.1.1.176
irlwinning.com.		21600	IN	A	1.1.1.177
irlwinning.com.		21600	IN	A	1.1.1.178
irlwinning.com.		21600	IN	A	1.1.1.179
irlwinning.com.		21600	IN	A	1.1.1.180
irlwinning.com.		21600	IN	A	1.1.1.181
irlwinning.com.		21600	IN	A	1.1.1.182
irlwinning.com.		21600	IN	A	1.1.1.183
irlwinning.com.		21600	IN	A	1.1.1.184
irlwinning.com.		21600	IN	A	1.1.1.185
irlwinning.com.		21600	IN	A	1.1.1.186
irlwinning.com.		21600	IN	A	1.1.1.187
irlwinning.com.		21600	IN	A	1.1.1.188
irlwinning.com.		21600	IN	A	1.1.1.189
irlwinning.com.		21600	IN	A	1.1.1.190
irlwinning.com.		21600	IN	A	1.1.1.191
irlwinning.com.		21600	IN	A	1.1.1.192
irlwinning.com.		21600	IN	A	1.1.1.193
irlwinning.com.		21600	IN	A	1.1.1.194
irlwinning.com.		21600	IN	A	1.1.1.195
irlwinning.com.		21600	IN	A	1.1.1.196
irlwinning.com.		21600	IN	A	1.1.1.197
irlwinning.com.		21600	IN	A	1.1.1.198
irlwinning.com.		21600	IN	A	1.1.1.199
irlwinning.com.		21600	IN	A	1.1.1.200
irlwinning.com.		21600	IN	A	1.1.1.201
irlwinning.com.		21600	IN	A	1.1.1.202
irlwinning.com.		21600	IN	A	1.1.1.203
irlwinning.com.		21600	IN	A	1.1.1.204
irlwinning.com.		21600	IN	A	1.1.1.205
irlwinning.com.		21600	IN	A	1.1.1.206
irlwinning.com.		21600	IN	A	1.1.1.207
irlwinning.com.		21600	IN	A	1.1.1.208
irlwinning.com.		21600	IN	A	1.1.1.209
irlwinning.com.		21600	IN	A	1.1.1.210
irlwinning.com.		21600	IN	A	1.1.1.211
irlwinning.com.		21600	IN	A	1.1.1.212
irlwinning.com.		21600	IN	A	1.1.1.213
irlwinning.com.		21600	IN	A	1.1.1.214
irlwinning.com.		21600	IN	A	1.1.1.215
irlwinning.com.		21600	IN	A	1.1.1.216
irlwinning.com.		21600	IN	A	1.1.1.217
irlwinning.com.		21600	IN	A	1.1.1.218
irlwinning.com.		21600	IN	A	1.1.1.219
irlwinning.com.		21600	IN	A	1.1.1.220
irlwinning.com.		21600	IN	A	1.1.1.221
irlwinning.com.		21600	IN	A	1.1.1.222
irlwinning.com.		21600	IN	A	1.1.1.223
irlwinning.com.		21600	IN	A	1.1.1.224
irlwinning.com.		21600	IN	A	1.1.1.225
irlwinning.com.		21600	IN	A	1.1.1.226
irlwinning.com.		21600	IN	A	1.1.1.227
irlwinning.com.		21600	IN	A	1.1.1.228
irlwinning.com.		21600	IN	A	1.1.1.229
irlwinning.com.		21600	IN	A	1.1.1.230
irlwinning.com.		21600	IN	A	1.1.1.231
irlwinning.com.		21600	IN	A	1.1.1.232
irlwinning.com.		21600	IN	A	1.1.1.233
irlwinning.com.		21600	IN	A	1.1.1.234
irlwinning.com.		21600	IN	A	1.1.1.235
irlwinning.com.		21600	IN	A	1.1.1.236
irlwinning.com.		21600	IN	A	1.1.1.237
irlwinning.com.		21600	IN	A	1.1.1.238
irlwinning.com.		21600	IN	A	1.1.1.239
irlwinning.com.		21600	IN	A	1.1.1.240
irlwinning.com.		21600	IN	A	1.1.1.241
irlwinning.com.		21600	IN	A	1.1.1.1
irlwinning.com.		21600	IN	A	1.1.1.2
irlwinning.com.		21600	IN	A	1.1.1.3
irlwinning.com.		21600	IN	A	1.1.1.4
irlwinning.com.		21600	IN	A	1.1.1.5
irlwinning.com.		21600	IN	A	1.1.1.6
irlwinning.com.		21600	IN	A	1.1.1.7
irlwinning.com.		21600	IN	A	1.1.1.8
irlwinning.com.		21600	IN	A	1.1.1.9
irlwinning.com.		21600	IN	A	1.1.1.10
irlwinning.com.		21600	IN	A	1.1.1.11
irlwinning.com.		21600	IN	A	1.1.1.12
irlwinning.com.		21600	IN	A	1.1.1.13
irlwinning.com.		21600	IN	A	1.1.1.14
irlwinning.com.		21600	IN	A	1.1.1.15
irlwinning.com.		21600	IN	A	1.1.1.16
irlwinning.com.		21600	IN	A	1.1.1.17
irlwinning.com.		21600	IN	A	1.1.1.18
irlwinning.com.		21600	IN	A	1.1.1.19
irlwinning.com.		21600	IN	A	1.1.1.20
irlwinning.com.		21600	IN	A	1.1.1.21
irlwinning.com.		21600	IN	A	1.1.1.22
irlwinning.com.		21600	IN	A	1.1.1.23
irlwinning.com.		21600	IN	A	1.1.1.24
irlwinning.com.		21600	IN	A	1.1.1.25
irlwinning.com.		21600	IN	A	1.1.1.26
irlwinning.com.		21600	IN	A	1.1.1.27
irlwinning.com.		21600	IN	A	1.1.1.28
irlwinning.com.		21600	IN	A	1.1.1.29
irlwinning.com.		21600	IN	A	1.1.1.30
irlwinning.com.		21600	IN	A	1.1.1.31
irlwinning.com.		21600	IN	A	1.1.1.32
irlwinning.com.		21600	IN	A	1.1.1.33
irlwinning.com.		21600	IN	A	1.1.1.34
irlwinning.com.		21600	IN	A	1.1.1.35
irlwinning.com.		21600	IN	A	1.1.1.36
irlwinning.com.		21600	IN	A	1.1.1.37
irlwinning.com.		21600	IN	A	1.1.1.38
irlwinning.com.		21600	IN	A	1.1.1.39
irlwinning.com.		21600	IN	A	1.1.1.40
irlwinning.com.		21600	IN	A	1.1.1.41
irlwinning.com.		21600	IN	A	1.1.1.42
irlwinning.com.		21600	IN	A	1.1.1.43
irlwinning.com.		21600	IN	A	1.1.1.44
irlwinning.com.		21600	IN	A	1.1.1.45
irlwinning.com.		21600	IN	A	1.1.1.46
irlwinning.com.		21600	IN	A	1.1.1.47
irlwinning.com.		21600	IN	A	1.1.1.48
irlwinning.com.		21600	IN	A	1.1.1.49
irlwinning.com.		21600	IN	A	1.1.1.50
irlwinning.com.		21600	IN	A	1.1.1.51
irlwinning.com.		21600	IN	A	1.1.1.52
irlwinning.com.		21600	IN	A	1.1.1.53
irlwinning.com.		21600	IN	A	1.1.1.54
irlwinning.com.		21600	IN	A	1.1.1.55
irlwinning.com.		21600	IN	A	1.1.1.56
irlwinning.com.		21600	IN	A	1.1.1.57
irlwinning.com.		21600	IN	A	1.1.1.58
irlwinning.com.		21600	IN	A	1.1.1.59
irlwinning.com.		21600	IN	A	1.1.1.60
irlwinning.com.		21600	IN	A	1.1.1.61
irlwinning.com.		21600	IN	A	1.1.1.62
irlwinning.com.		21600	IN	A	1.1.1.63
irlwinning.com.		21600	IN	A	1.1.1.64
irlwinning.com.		21600	IN	A	1.1.1.65
irlwinning.com.		21600	IN	A	1.1.1.66
irlwinning.com.		21600	IN	A	1.1.1.67
irlwinning.com.		21600	IN	A	1.1.1.68
irlwinning.com.		21600	IN	A	1.1.1.69
irlwinning.com.		21600	IN	A	1.1.1.70
irlwinning.com.		21600	IN	A	1.1.1.71
irlwinning.com.		21600	IN	A	1.1.1.72
irlwinning.com.		21600	IN	A	1.1.1.73
irlwinning.com.		21600	IN	A	1.1.1.74
irlwinning.com.		21600	IN	A	1.1.1.75
irlwinning.com.		21600	IN	A	1.1.1.76
irlwinning.com.		21600	IN	A	1.1.1.77
irlwinning.com.		21600	IN	A	1.1.1.78
irlwinning.com.		21600	IN	A	1.1.1.79
irlwinning.com.		21600	IN	A	1.1.1.80
irlwinning.com.		21600	IN	A	1.1.1.81
irlwinning.com.		21600	IN	A	1.1.1.82
irlwinning.com.		21600	IN	A	1.1.1.83
irlwinning.com.		21600	IN	A	1.1.1.84
irlwinning.com.		21600	IN	A	1.1.1.85
irlwinning.com.		21600	IN	A	1.1.1.86
irlwinning.com.		21600	IN	A	1.1.1.87
irlwinning.com.		21600	IN	A	1.1.1.88
irlwinning.com.		21600	IN	A	1.1.1.89
irlwinning.com.		21600	IN	A	1.1.1.90
irlwinning.com.		21600	IN	A	1.1.1.91
irlwinning.com.		21600	IN	A	1.1.1.92
irlwinning.com.		21600	IN	A	1.1.1.93
irlwinning.com.		21600	IN	A	1.1.1.94
irlwinning.com.		21600	IN	A	1.1.1.95
irlwinning.com.		21600	IN	A	1.1.1.96
irlwinning.com.		21600	IN	A	1.1.1.97
irlwinning.com.		21600	IN	A	1.1.1.98
irlwinning.com.		21600	IN	A	1.1.1.99
irlwinning.com.		21600	IN	A	1.1.1.100
irlwinning.com.		21600	IN	A	1.1.1.101
irlwinning.com.		21600	IN	A	1.1.1.102
irlwinning.com.		21600	IN	A	1.1.1.103
irlwinning.com.		21600	IN	A	1.1.1.104
irlwinning.com.		21600	IN	A	1.1.1.105
irlwinning.com.		21600	IN	A	1.1.1.106
irlwinning.com.		21600	IN	A	1.1.1.107
irlwinning.com.		21600	IN	A	1.1.1.108
irlwinning.com.		21600	IN	A	1.1.1.109
irlwinning.com.		21600	IN	A	1.1.1.110
irlwinning.com.		21600	IN	A	1.1.1.111
irlwinning.com.		21600	IN	A	1.1.1.112
irlwinning.com.		21600	IN	A	1.1.1.113
irlwinning.com.		21600	IN	A	1.1.1.114
irlwinning.com.		21600	IN	A	1.1.1.115
irlwinning.com.		21600	IN	A	1.1.1.116
irlwinning.com.		21600	IN	A	1.1.1.117
irlwinning.com.		21600	IN	A	1.1.1.118
irlwinning.com.		21600	IN	A	1.1.1.119
irlwinning.com.		21600	IN	A	1.1.1.120
irlwinning.com.		21600	IN	A	1.1.1.121
irlwinning.com.		21600	IN	A	1.1.1.122
irlwinning.com.		21600	IN	A	1.1.1.123
irlwinning.com.		21600	IN	A	1.1.1.124
irlwinning.com.		21600	IN	A	1.1.1.125
irlwinning.com.		21600	IN	A	1.1.1.126
irlwinning.com.		21600	IN	A	1.1.1.127
irlwinning.com.		21600	IN	A	1.1.1.128
irlwinning.com.		21600	IN	A	1.1.1.129
irlwinning.com.		21600	IN	A	1.1.1.130
irlwinning.com.		21600	IN	A	1.1.1.131
irlwinning.com.		21600	IN	A	1.1.1.132
irlwinning.com.		21600	IN	A	1.1.1.133
irlwinning.com.		21600	IN	A	1.1.1.134
irlwinning.com.		21600	IN	A	1.1.1.135
irlwinning.com.		21600	IN	A	1.1.1.136
irlwinning.com.		21600	IN	A	1.1.1.137
irlwinning.com.		21600	IN	A	1.1.1.138
irlwinning.com.		21600	IN	A	1.1.1.139
irlwinning.com.		21600	IN	A	1.1.1.140
irlwinning.com.		21600	IN	A	1.1.1.141
irlwinning.com.		21600	IN	A	1.1.1.142
irlwinning.com.		21600	IN	A	1.1.1.143
irlwinning.com.		21600	IN	A	1.1.1.144
irlwinning.com.		21600	IN	A	1.1.1.145
irlwinning.com.		21600	IN	A	1.1.1.146
irlwinning.com.		900	IN	SOA	ns1.irlwinning.com. packets.irlwinning.com. 2013230901 900 900 900 900

;; ADDITIONAL SECTION:
ns1.irlwinning.com.	20371	IN	A	94.102.56.150
ns2.irlwinning.com.	20371	IN	A	94.102.56.150

;; Query time: 16 msec
;; SERVER: ::1#53(::1)
;; WHEN: Mon Oct  7 13:04:20 2013
;; MSG SIZE  rcvd: 4000
$ whois 94.102.56.150

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#


#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 94.102.56.150"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=94.102.56.150?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       94.0.0.0 - 94.255.255.255
CIDR:           94.0.0.0/8
OriginAS:
NetName:        94-RIPE
NetHandle:      NET-94-0-0-0-1
Parent:
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
RegDate:        2007-07-30
Updated:        2009-05-18
Ref:            http://whois.arin.net/rest/net/NET-94-0-0-0-1

OrgName:        RIPE Network Coordination Centre
OrgId:          RIPE
Address:        P.O. Box 10096
City:           Amsterdam
StateProv:
PostalCode:     1001EB
Country:        NL
RegDate:
Updated:        2013-07-29
Ref:            http://whois.arin.net/rest/org/RIPE

ReferralServer: whois://whois.ripe.net:43

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName:   Abuse Contact
OrgAbusePhone:  +31205354444
OrgAbuseEmail:  abuse@ripe.net
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName:   RIPE NCC Operations
OrgTechPhone:  +31 20 535 4444
OrgTechEmail:  hostmaster@ripe.net
OrgTechRef:    http://whois.arin.net/rest/poc/RNO29-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '94.102.56.0 - 94.102.56.255'

inetnum:        94.102.56.0 - 94.102.56.255
netname:        NL-ECATEL
descr:          AS29073, Ecatel LTD
country:        NL
admin-c:        EL25-RIPE
tech-c:         EL25-RIPE
status:         ASSIGNED PA
mnt-by:         ECATEL-MNT
mnt-lower:      ECATEL-MNT
mnt-routes:     ECATEL-MNT
source:         RIPE # Filtered

role:           Ecatel LTD
address:        P.O.Box  19533
address:        2521 CA The Hague
address:        Netherlands
abuse-mailbox:  abuse@ecatel.info
remarks:        ----------------------------------------------------
remarks:        ECATEL LTD
remarks:        Dedicated and Co-location hosting services
remarks:        ----------------------------------------------------
remarks:        for abuse complaints : abuse@ecatel.info
remarks:        for any other questions : info@ecatel.info
remarks:        ----------------------------------------------------
admin-c:        EL25-RIPE
tech-c:         EL25-RIPE
nic-hdl:        EL25-RIPE
mnt-by:         ECATEL-MNT
source:         RIPE # Filtered

% Information related to '94.102.48.0/20AS29073'

route:          94.102.48.0/20
descr:          AS29073 Route object
origin:         AS29073
mnt-by:         ECATEL-MNT
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.69 (WHOIS3)

DNSアンプ攻撃観測 (pkts.asia)

数日引けなくなっていたpkts.asiaが復活していて,攻撃に使われている.

whois情報は登録されてない.

US, CA, California, Los Angeles

$ dig @::1 pkts.asia any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.6-P1 <<>> @::1 pkts.asia any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47514
;; flags: qr rd ra; QUERY: 1, ANSWER: 245, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;pkts.asia.			IN	ANY

;; ANSWER SECTION:
pkts.asia.		20867	IN	NS	ns2.pkts.asia.
pkts.asia.		20867	IN	NS	ns1.pkts.asia.
pkts.asia.		20867	IN	A	1.1.1.14
pkts.asia.		20867	IN	A	1.1.1.15
pkts.asia.		20867	IN	A	1.1.1.16
pkts.asia.		20867	IN	A	1.1.1.17
pkts.asia.		20867	IN	A	1.1.1.18
pkts.asia.		20867	IN	A	1.1.1.19
pkts.asia.		20867	IN	A	1.1.1.20
pkts.asia.		20867	IN	A	1.1.1.21
pkts.asia.		20867	IN	A	1.1.1.22
pkts.asia.		20867	IN	A	1.1.1.23
pkts.asia.		20867	IN	A	1.1.1.24
pkts.asia.		20867	IN	A	1.1.1.25
pkts.asia.		20867	IN	A	1.1.1.26
pkts.asia.		20867	IN	A	1.1.1.27
pkts.asia.		20867	IN	A	1.1.1.28
pkts.asia.		20867	IN	A	1.1.1.29
pkts.asia.		20867	IN	A	1.1.1.30
pkts.asia.		20867	IN	A	1.1.1.31
pkts.asia.		20867	IN	A	1.1.1.32
pkts.asia.		20867	IN	A	1.1.1.33
pkts.asia.		20867	IN	A	1.1.1.34
pkts.asia.		20867	IN	A	1.1.1.35
pkts.asia.		20867	IN	A	1.1.1.36
pkts.asia.		20867	IN	A	1.1.1.37
pkts.asia.		20867	IN	A	1.1.1.38
pkts.asia.		20867	IN	A	1.1.1.39
pkts.asia.		20867	IN	A	1.1.1.40
pkts.asia.		20867	IN	A	1.1.1.41
pkts.asia.		20867	IN	A	1.1.1.42
pkts.asia.		20867	IN	A	1.1.1.43
pkts.asia.		20867	IN	A	1.1.1.44
pkts.asia.		20867	IN	A	1.1.1.45
pkts.asia.		20867	IN	A	1.1.1.46
pkts.asia.		20867	IN	A	1.1.1.47
pkts.asia.		20867	IN	A	1.1.1.48
pkts.asia.		20867	IN	A	1.1.1.49
pkts.asia.		20867	IN	A	1.1.1.50
pkts.asia.		20867	IN	A	1.1.1.51
pkts.asia.		20867	IN	A	1.1.1.52
pkts.asia.		20867	IN	A	1.1.1.53
pkts.asia.		20867	IN	A	1.1.1.54
pkts.asia.		20867	IN	A	1.1.1.55
pkts.asia.		20867	IN	A	1.1.1.56
pkts.asia.		20867	IN	A	1.1.1.57
pkts.asia.		20867	IN	A	1.1.1.58
pkts.asia.		20867	IN	A	1.1.1.59
pkts.asia.		20867	IN	A	1.1.1.60
pkts.asia.		20867	IN	A	1.1.1.61
pkts.asia.		20867	IN	A	1.1.1.62
pkts.asia.		20867	IN	A	1.1.1.63
pkts.asia.		20867	IN	A	1.1.1.64
pkts.asia.		20867	IN	A	1.1.1.65
pkts.asia.		20867	IN	A	1.1.1.66
pkts.asia.		20867	IN	A	1.1.1.67
pkts.asia.		20867	IN	A	1.1.1.68
pkts.asia.		20867	IN	A	1.1.1.69
pkts.asia.		20867	IN	A	1.1.1.70
pkts.asia.		20867	IN	A	1.1.1.71
pkts.asia.		20867	IN	A	1.1.1.72
pkts.asia.		20867	IN	A	1.1.1.73
pkts.asia.		20867	IN	A	1.1.1.74
pkts.asia.		20867	IN	A	1.1.1.75
pkts.asia.		20867	IN	A	1.1.1.76
pkts.asia.		20867	IN	A	1.1.1.77
pkts.asia.		20867	IN	A	1.1.1.78
pkts.asia.		20867	IN	A	1.1.1.79
pkts.asia.		20867	IN	A	1.1.1.80
pkts.asia.		20867	IN	A	1.1.1.81
pkts.asia.		20867	IN	A	1.1.1.82
pkts.asia.		20867	IN	A	1.1.1.83
pkts.asia.		20867	IN	A	1.1.1.84
pkts.asia.		20867	IN	A	1.1.1.85
pkts.asia.		20867	IN	A	1.1.1.86
pkts.asia.		20867	IN	A	1.1.1.87
pkts.asia.		20867	IN	A	1.1.1.88
pkts.asia.		20867	IN	A	1.1.1.89
pkts.asia.		20867	IN	A	1.1.1.90
pkts.asia.		20867	IN	A	1.1.1.91
pkts.asia.		20867	IN	A	1.1.1.92
pkts.asia.		20867	IN	A	1.1.1.93
pkts.asia.		20867	IN	A	1.1.1.94
pkts.asia.		20867	IN	A	1.1.1.95
pkts.asia.		20867	IN	A	1.1.1.96
pkts.asia.		20867	IN	A	1.1.1.97
pkts.asia.		20867	IN	A	1.1.1.98
pkts.asia.		20867	IN	A	1.1.1.99
pkts.asia.		20867	IN	A	1.1.1.100
pkts.asia.		20867	IN	A	1.1.1.101
pkts.asia.		20867	IN	A	1.1.1.102
pkts.asia.		20867	IN	A	1.1.1.103
pkts.asia.		20867	IN	A	1.1.1.104
pkts.asia.		20867	IN	A	1.1.1.105
pkts.asia.		20867	IN	A	1.1.1.106
pkts.asia.		20867	IN	A	1.1.1.107
pkts.asia.		20867	IN	A	1.1.1.108
pkts.asia.		20867	IN	A	1.1.1.109
pkts.asia.		20867	IN	A	1.1.1.110
pkts.asia.		20867	IN	A	1.1.1.111
pkts.asia.		20867	IN	A	1.1.1.112
pkts.asia.		20867	IN	A	1.1.1.113
pkts.asia.		20867	IN	A	1.1.1.114
pkts.asia.		20867	IN	A	1.1.1.115
pkts.asia.		20867	IN	A	1.1.1.116
pkts.asia.		20867	IN	A	1.1.1.117
pkts.asia.		20867	IN	A	1.1.1.118
pkts.asia.		20867	IN	A	1.1.1.119
pkts.asia.		20867	IN	A	1.1.1.120
pkts.asia.		20867	IN	A	1.1.1.121
pkts.asia.		20867	IN	A	1.1.1.122
pkts.asia.		20867	IN	A	1.1.1.123
pkts.asia.		20867	IN	A	1.1.1.124
pkts.asia.		20867	IN	A	1.1.1.125
pkts.asia.		20867	IN	A	1.1.1.126
pkts.asia.		20867	IN	A	1.1.1.127
pkts.asia.		20867	IN	A	1.1.1.128
pkts.asia.		20867	IN	A	1.1.1.129
pkts.asia.		20867	IN	A	1.1.1.130
pkts.asia.		20867	IN	A	1.1.1.131
pkts.asia.		20867	IN	A	1.1.1.132
pkts.asia.		20867	IN	A	1.1.1.133
pkts.asia.		20867	IN	A	1.1.1.134
pkts.asia.		20867	IN	A	1.1.1.135
pkts.asia.		20867	IN	A	1.1.1.136
pkts.asia.		20867	IN	A	1.1.1.137
pkts.asia.		20867	IN	A	1.1.1.138
pkts.asia.		20867	IN	A	1.1.1.139
pkts.asia.		20867	IN	A	1.1.1.140
pkts.asia.		20867	IN	A	1.1.1.141
pkts.asia.		20867	IN	A	1.1.1.142
pkts.asia.		20867	IN	A	1.1.1.143
pkts.asia.		20867	IN	A	1.1.1.144
pkts.asia.		20867	IN	A	1.1.1.145
pkts.asia.		20867	IN	A	1.1.1.146
pkts.asia.		20867	IN	A	1.1.1.147
pkts.asia.		20867	IN	A	1.1.1.148
pkts.asia.		20867	IN	A	1.1.1.149
pkts.asia.		20867	IN	A	1.1.1.150
pkts.asia.		20867	IN	A	1.1.1.151
pkts.asia.		20867	IN	A	1.1.1.152
pkts.asia.		20867	IN	A	1.1.1.153
pkts.asia.		20867	IN	A	1.1.1.154
pkts.asia.		20867	IN	A	1.1.1.155
pkts.asia.		20867	IN	A	1.1.1.156
pkts.asia.		20867	IN	A	1.1.1.157
pkts.asia.		20867	IN	A	1.1.1.158
pkts.asia.		20867	IN	A	1.1.1.159
pkts.asia.		20867	IN	A	1.1.1.160
pkts.asia.		20867	IN	A	1.1.1.161
pkts.asia.		20867	IN	A	1.1.1.162
pkts.asia.		20867	IN	A	1.1.1.163
pkts.asia.		20867	IN	A	1.1.1.164
pkts.asia.		20867	IN	A	1.1.1.165
pkts.asia.		20867	IN	A	1.1.1.166
pkts.asia.		20867	IN	A	1.1.1.167
pkts.asia.		20867	IN	A	1.1.1.168
pkts.asia.		20867	IN	A	1.1.1.169
pkts.asia.		20867	IN	A	1.1.1.170
pkts.asia.		20867	IN	A	1.1.1.171
pkts.asia.		20867	IN	A	1.1.1.172
pkts.asia.		20867	IN	A	1.1.1.173
pkts.asia.		20867	IN	A	1.1.1.174
pkts.asia.		20867	IN	A	1.1.1.175
pkts.asia.		20867	IN	A	1.1.1.176
pkts.asia.		20867	IN	A	1.1.1.177
pkts.asia.		20867	IN	A	1.1.1.178
pkts.asia.		20867	IN	A	1.1.1.179
pkts.asia.		20867	IN	A	1.1.1.180
pkts.asia.		20867	IN	A	1.1.1.181
pkts.asia.		20867	IN	A	1.1.1.182
pkts.asia.		20867	IN	A	1.1.1.183
pkts.asia.		20867	IN	A	1.1.1.184
pkts.asia.		20867	IN	A	1.1.1.185
pkts.asia.		20867	IN	A	1.1.1.186
pkts.asia.		20867	IN	A	1.1.1.187
pkts.asia.		20867	IN	A	1.1.1.188
pkts.asia.		20867	IN	A	1.1.1.189
pkts.asia.		20867	IN	A	1.1.1.190
pkts.asia.		20867	IN	A	1.1.1.191
pkts.asia.		20867	IN	A	1.1.1.192
pkts.asia.		20867	IN	A	1.1.1.193
pkts.asia.		20867	IN	A	1.1.1.194
pkts.asia.		20867	IN	A	1.1.1.195
pkts.asia.		20867	IN	A	1.1.1.196
pkts.asia.		20867	IN	A	1.1.1.197
pkts.asia.		20867	IN	A	1.1.1.198
pkts.asia.		20867	IN	A	1.1.1.199
pkts.asia.		20867	IN	A	1.1.1.200
pkts.asia.		20867	IN	A	1.1.1.201
pkts.asia.		20867	IN	A	1.1.1.202
pkts.asia.		20867	IN	A	1.1.1.203
pkts.asia.		20867	IN	A	1.1.1.204
pkts.asia.		20867	IN	A	1.1.1.205
pkts.asia.		20867	IN	A	1.1.1.206
pkts.asia.		20867	IN	A	1.1.1.207
pkts.asia.		20867	IN	A	1.1.1.208
pkts.asia.		20867	IN	A	1.1.1.209
pkts.asia.		20867	IN	A	1.1.1.210
pkts.asia.		20867	IN	A	1.1.1.211
pkts.asia.		20867	IN	A	1.1.1.212
pkts.asia.		20867	IN	A	1.1.1.213
pkts.asia.		20867	IN	A	1.1.1.214
pkts.asia.		20867	IN	A	1.1.1.215
pkts.asia.		20867	IN	A	1.1.1.216
pkts.asia.		20867	IN	A	1.1.1.217
pkts.asia.		20867	IN	A	1.1.1.218
pkts.asia.		20867	IN	A	1.1.1.219
pkts.asia.		20867	IN	A	1.1.1.220
pkts.asia.		20867	IN	A	1.1.1.221
pkts.asia.		20867	IN	A	1.1.1.222
pkts.asia.		20867	IN	A	1.1.1.223
pkts.asia.		20867	IN	A	1.1.1.224
pkts.asia.		20867	IN	A	1.1.1.225
pkts.asia.		20867	IN	A	1.1.1.226
pkts.asia.		20867	IN	A	1.1.1.227
pkts.asia.		20867	IN	A	1.1.1.228
pkts.asia.		20867	IN	A	1.1.1.229
pkts.asia.		20867	IN	A	1.1.1.230
pkts.asia.		20867	IN	A	1.1.1.231
pkts.asia.		20867	IN	A	1.1.1.232
pkts.asia.		20867	IN	A	1.1.1.233
pkts.asia.		20867	IN	A	1.1.1.234
pkts.asia.		20867	IN	A	1.1.1.235
pkts.asia.		20867	IN	A	1.1.1.236
pkts.asia.		20867	IN	A	1.1.1.237
pkts.asia.		20867	IN	A	1.1.1.238
pkts.asia.		20867	IN	A	1.1.1.239
pkts.asia.		20867	IN	A	1.1.1.240
pkts.asia.		20867	IN	A	1.1.1.241
pkts.asia.		20867	IN	A	1.1.1.242
pkts.asia.		20867	IN	A	1.1.1.1
pkts.asia.		20867	IN	A	1.1.1.2
pkts.asia.		20867	IN	A	1.1.1.3
pkts.asia.		20867	IN	A	1.1.1.4
pkts.asia.		20867	IN	A	1.1.1.5
pkts.asia.		20867	IN	A	1.1.1.6
pkts.asia.		20867	IN	A	1.1.1.7
pkts.asia.		20867	IN	A	1.1.1.8
pkts.asia.		20867	IN	A	1.1.1.9
pkts.asia.		20867	IN	A	1.1.1.10
pkts.asia.		20867	IN	A	1.1.1.11
pkts.asia.		20867	IN	A	1.1.1.12
pkts.asia.		20867	IN	A	1.1.1.13
pkts.asia.		20867	IN	SOA	ns1.pkts.asia. udp.pkts.asia. 2013300901 21600 21600 21600 21600

;; ADDITIONAL SECTION:
ns1.pkts.asia.		20867	IN	A	69.42.219.74
ns2.pkts.asia.		20867	IN	A	69.42.219.74

;; Query time: 9 msec
;; SERVER: ::1#53(::1)
;; WHEN: Mon Oct  7 12:55:14 2013
;; MSG SIZE  rcvd: 4007