Hi, Some unbounds are misbehaving here :)
We are under attack, as you can see: # ./top-domain.sh 41285 amazonaws.com 41919 googleapis.com 42303 fbcdn.net 59289 root-servers.net 61485 whatsapp.net 75474 akamai.net 167995 facebook.com 181346 google.com 208779 akamaihd.net 384725 315ye.zj.cn No doubt, when looking into the log, there is a lot of queries going on: # tail -n 1000 unbound.log | grep '315ye.zj.cn' [1462404661] unbound[32679:7] info: x.x.x.x heghnlxhdjd.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x rgdtbdcpire.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x gtkvcringtidqt.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x ashcjctstvm.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x knypkraxsfcfob.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x irmfuzchub.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x evajqb.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x mlshiz.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x kbedwjgrgb.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x ihkdutetkx.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x cbwhmlolylyfozgt.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x yjinkfudktsj.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x ynmlktcdit.315ye.zj.cn. A IN [1462404661] unbound[32679:4] info: x.x.x.x ir.315ye.zj.cn. A IN [1462404661] unbound[32679:5] info: x.x.x.x qnefwbmhktat.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x qanthkajjdo.315ye.zj.cn. A IN [1462404661] unbound[32679:4] info: x.x.x.x sh.315ye.zj.cn. A IN [1462404661] unbound[32679:4] info: x.x.x.x mhgxitap.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x mtwbmvetidkbov.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x mfezktetldm.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x fldrduebgre.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ifgb.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x dhbsbrqlatz.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x gzebilwhgl.315ye.zj.cn. A IN [1462404661] unbound[32679:5] info: x.x.x.x mlktchobab.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x qnehgfwt.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x ercpmnmlovwr.315ye.zj.cn. A IN [1462404661] unbound[32679:5] info: x.x.x.x ufevershyvmv.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x yvorcxanet.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x qxafih.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x arqfmjcrev.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x wncrmvohmnclqbux.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x ypejmtmhklkhex.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x qlyzyh.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x ijovajovwzqzcv.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x ejwxojsdulmd.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x mxohwbid.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x ed.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ipuzehgfuf.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ct.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x alkbcp.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ilunwruryl.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x sdedkj.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x exkbsf.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x kxexyl.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x wtqvafcfcpynotkl.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x wvmnijebmnwb.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x czkvahipspyzypsp.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x atqvqxwruderuj.315ye.zj.cn. A IN [1462404661] unbound[32679:4] info: x.x.x.x ozstgdcped.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x alozon.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x afaxcdyfipavynix.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x cfereredizmfktcd.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x qj.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x jgdgywedmhy.315ye.zj.cn. A IN [1462404661] unbound[32679:5] info: x.x.x.x gpmputgd.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x mlyhot.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x cn.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x cjaxojix.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x qvopovizkxkn.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x gb.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x qpilofyjgzqt.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x mfczcfwletylip.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x crmbyjejcvojan.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x uxijabmhenmp.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x cfqn.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x qnehgfwt.315ye.zj.cn. A IN [1462404661] unbound[32679:5] info: x.x.x.x ypkpstinkjcpwn.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x wpqpalip.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x ojojexgxuxkp.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x afwx.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x ydet.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x ubgnehytstyn.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x cxszorejad.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x qdwnunyd.315ye.zj.cn. A IN [1462404661] unbound[32679:5] info: x.x.x.x yxonmpulmlgv.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x pfexcmznbub.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x wvcxwxovahkpkj.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x iz.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ijcvgrifcfif.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x sfat.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x ozwr.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x ad.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x sd.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x sxipsnuvwlybcxmp.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x mfif.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x exkpinodon.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x uv.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x wvsfyxklelcfmh.315ye.zj.cn. A IN [1462404661] unbound[32679:7] info: x.x.x.x izklyhmrqfotoh.315ye.zj.cn. A IN [1462404661] unbound[32679:5] info: x.x.x.x gdofqrit.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x yhgpexsn.315ye.zj.cn. A IN [1462404661] unbound[32679:1] info: x.x.x.x gzwd.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x yxofqbuxchapwdqx.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x ghwvulohmjkzgx.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x wzuxsxivyhqd.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ofir.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x mp.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x glsbwl.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x irsxmpkrqlsp.315ye.zj.cn. A IN [1462404661] unbound[32679:4] info: x.x.x.x wlgjslobkd.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ijmhqfixqxaxut.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x edwjqd.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x op.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x qbqj.315ye.zj.cn. A IN [1462404661] unbound[32679:4] info: x.x.x.x yvytefatgj.315ye.zj.cn. A IN [1462404661] unbound[32679:5] info: x.x.x.x ulinkd.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ytmrmh.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x yjinkfudktsj.315ye.zj.cn. A IN [1462404661] unbound[32679:6] info: x.x.x.x gt.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x ihof.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x mnytsripyrqv.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x aruzihur.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x urslyxcdmdmnmd.315ye.zj.cn. A IN [1462404661] unbound[32679:3] info: x.x.x.x sdirknkz.315ye.zj.cn. A IN [1462404661] unbound[32679:0] info: x.x.x.x mzodkloruz.315ye.zj.cn. A IN [1462404661] unbound[32679:2] info: x.x.x.x mrahej.315ye.zj.cn. A IN But unbound-control told me there is no attack: # unbound-control ratelimit_list +a | grep '315ye.zj.cn' 315ye.zj.cn. 0 limit 25 My unbound is: Version 1.5.8 linked libs: libevent 2.0.16-stable (it uses epoll), OpenSSL 1.0.1 14 Mar 2012 linked modules: dns64 validator iterator BSD licensed, see LICENSE in source package for details. Report bugs to [email protected] My system: # cat /etc/issue Ubuntu 12.04.5 LTS \n \l # uname -a Linux dns 3.13.0-68-generic #111~precise1-Ubuntu SMP Fri Nov 6 18:17:31 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux What can be the problem? Thank you. Best regards, -- Eduardo Schoedler
