Discuss mailing list

[Peter Green <peter AT greenpete.co.uk>]

Hi,

I am getting this line in my named log about once per second...

"08-Mar-2012 23:10:30.885 client 212.227.135.196#80: query: isc.org IN 
ANY +ED (83.142.229.97)"

It seems to be an extremely close match to the attack mentioned here...
http://wiki.opennicproject.org/ddosBlock

That script seems to be aimed at port 25345 where as my log seems to 
show port 80.

Will Jeff's script help and if so, do I simply run it from crontab 
every second?

I am concerned this may start to impact the websites I am hosting on 
that server.

I have never added this server to the public list, and wonder why it's 
being targeted.

I hope someone can help.

Peter