In message <[email protected]>, Makara writes: > Hi, > > I'm dns administrator, please give me an excuse if it's not the right place > to ask the question. My dns server is attacked, below are the log
You are not being attacked. The zone 26.178.115.in-addr.arpa is delegated to you but you are not configured to serve it. 26.178.115.in-addr.arpa. 86400 IN NS ns01.digi.com.kh. 26.178.115.in-addr.arpa. 86400 IN NS ns02.digi.com.kh. You are seeing other nameservers performing reverse lookups on the address in 26.178.115.in-addr.arpa. This will usually be because you made a connection to a service which uses these servers for reverse DNS lookups for access control or just logging where the request came from. Either remove the delegation or serve the 26.178.115.in-addr.arpa zone. Mark > Feb 4 06:26:29 ns01 named[7791]: client 204.194.238.15#42502: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 196.14.64.145#54363: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 66.33.216.129#58386: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 62.141.32.3#10049: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 203.220.10.226#27558: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 117.102.98.253#4696: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 208.69.34.8#52506: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 64.27.31.126#23550: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 195.25.5.65#49345: query (cache) > '110.25.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 208.65.201.98#20322: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 82.108.95.210#2104: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 65.39.178.17#53701: query (cache) > '200.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: FORMERR resolving ' > ns1.pendingrenewaldeletion.com/AAAA/IN': 205.178.190.51#53 > Feb 4 06:26:29 ns01 named[7791]: unexpected RCODE (REFUSED) resolving ' > cheappaintballgunstore.com/A/IN': 74.53.26.66#53 > Feb 4 06:26:29 ns01 named[7791]: client 85.115.52.190#24528: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 83.103.75.172#19067: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 66.119.189.138#63190: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 194.206.126.15#49858: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 72.232.214.226#10860: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: FORMERR resolving ' > ns2.pendingrenewaldeletion.com/AAAA/IN': 205.178.190.51#53 > Feb 4 06:26:29 ns01 named[7791]: client 83.243.8.6#26089: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 97.64.179.210#19383: query (cache) > '200.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 81.4.88.10#24179: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 66.33.216.208#8796: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 66.119.189.138#34887: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > Feb 4 06:26:29 ns01 named[7791]: client 208.67.219.11#39638: query (cache) > '118.26.178.115.in-addr.arpa/PTR/IN' denied > > > I'm using BIND 9.3.3rc2, any idea or advise how to solve the problem? it's > response so slow and some time is not response > -- > The person who loves others will also be loved. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: [email protected] _______________________________________________ bind-users mailing list [email protected] https://lists.isc.org/mailman/listinfo/bind-users
