On 27 Apr 2015, at 12:13, Randy Bush wrote:
nominum? msoft? so it is backscatter from doses toward them?
Well, if your server is an open recursor through misconfiguration (unlikely, I know) or some miscreant fatfingered a list, then maybe. Attackers tend to use lots of recursives in reflection/amplification attacks with limited numbers of queries for each one, and once you're on the list of open recursives, you still get pummeled every so often even after remediation/even if you weren't recursive in the first place.
----------------------------------- Roland Dobbins <[email protected]> _______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
