Discuss mailing list

[waqas <waqas281 AT gmail.com>]

8/20/2013 11:26:37 PM 061C PACKET  00000017087551C0 UDP Rcv 14.17.94.134    b978   Q [0001   D   NOERROR] TXT    (5)bfhmm(3)com(0)
8/20/2013 11:32:39 PM 052C PACKET  00000017082B0B40 UDP Snd 192.54.112.30   253c   Q [0200      SERVFAIL] A      (3)www(5)bfhmm(3)com(0)
8/20/2013 11:32:39 PM 052C PACKET  000000170A46DB90 UDP Snd 208.109.255.1   0efe   Q [0200      SERVFAIL] A      (5)bfhmm(3)com(0)

8/20/2013 11:32:40 PM 0618 PACKET  00000017084C8780 UDP Snd 14.18.141.6     ed3b R Q [8081   DR  NOERROR] TXT    (5)bfhmm(3)com(0)

these are just some of the examples, except one ip was sending hundreds of requests i just posted 4 dif ips. 
this was happening each time i blocked one ip another one poped up with same request i counted over 60 ips and i  finally took the server down.

On Wed, Aug 21, 2013 at 11:49 AM, Guillaume Parent <gparent AT gparent.org> wrote:

I'm just saying that right now, that domain answers NXDOMAIN for most of the planet. It doesn't really matter what domain they used.

On Wed, Aug 21, 2013 at 12:08 PM, Waqas Ashraf <waqas281 AT gmail.com> wrote:

I will post log give me few hours 

Sent from my iPhone

On Aug 21, 2013, at 10:51 AM, Guillaume Parent <gparent AT gparent.org> wrote:

That one doesn't exist either.

On Wed, Aug 21, 2013 at 11:43 AM, Waqas Ashraf <waqas281 AT gmail.com> wrote:

I'm sorry you're right it's  dfhmm.com

Sent from my iPhone

On Aug 21, 2013, at 7:44 AM, staticsafe <me AT staticsafe.ca> wrote:

> On Wed, Aug 21, 2013 at 07:31:09AM -0500, Waqas Ashraf wrote:
>> ns25.tx.us.dns.opennic.glue @ 98.200.95.139.
>> Server will be down once again due to massive txt request from dhfmm.com. I blocked excessive of 60+ different IPs. I tried to mitigate but it was late in night and due to day job had to take the sever down till I get some free time to work on it.
>>
>> Sent from my iPhone
>
> Did you make a typo? dhfmm.com does not exist.
> --
> staticsafe
> O< ascii ribbon campaign - stop html mail - www.asciiribbon.org
> Please don't top post.
> Please don't CC! I'm subscribed to whatever list I just posted on.
>
>
> --------
> You are a member of the OpenNIC Discuss list.
> You may unsubscribe by emailing discuss-unsubscribe AT lists.opennicproject.org


--------
You are a member of the OpenNIC Discuss list.
You may unsubscribe by emailing discuss-unsubscribe AT lists.opennicproject.org

--------
You are a member of the OpenNIC Discuss list.
You may unsubscribe by emailing discuss-unsubscribe AT lists.opennicproject.org

--------
You are a member of the OpenNIC Discuss list.
You may unsubscribe by emailing discuss-unsubscribe AT lists.opennicproject.org

--------
You are a member of the OpenNIC Discuss list.
You may unsubscribe by emailing discuss-unsubscribe AT lists.opennicproject.org