Hi all.
Our Windows DNS server has been logging hundreds of reverse dns requests for two IP's. These are being logged every 30 seconds or so.
The DNS server encountered an invalid domain name in a packet from 104.236.146.124. The packet will be rejected. The event data contains the DNS packet.
The DNS server encountered an invalid domain name in a packet from 192.34.59.231. The packet will be rejected. The event data contains the DNS packet.
104.236.146.124 resolves to whopper.fastlink.net
192.34.59.231 resolves to thumper.fastlink.net
I enabled debugging on the dns server to try trace what this is but am unsure how to interpret it. Here are the three entries that are logged for each request:
---------------------------------------------------------
27/02/2020 2:16:04 PM 0B7C PACKET 0000007719B8B6F0 UDP Snd 192.34.59.231 dc1f Q [0000 NOERROR] PTR (2)60(3)118(2)96(3)156(7)in-addr(4)arpa(0)
UDP question info at 0000007719B8B6F0
Socket = 11464
Remote addr 192.34.59.231, port 53
Time Query=0, Queued=0, Expire=0
Buf length = 0x0fa0 (4000)
Msg length = 0x002c (44)
Message:
XID 0xdc1f
Flags 0x0000
QR 0 (QUESTION)
OPCODE 0 (QUERY)
AA 0
TC 0
RD 0
RA 0
Z 0
CD 0
AD 0
RCODE 0 (NOERROR)
QCOUNT 1
ACOUNT 0
NSCOUNT 0
ARCOUNT 0
QUESTION SECTION:
Offset = 0x000c, RR count = 0
Name "(2)60(3)118(2)96(3)156(7)in-addr(4)arpa(0)"
QTYPE PTR (12)
QCLASS 1
ANSWER SECTION: empty
AUTHORITY SECTION: empty
ADDITIONAL SECTION: empty
27/02/2020 2:16:04 PM 0B7C PACKET 00000077143B2410 UDP Rcv 192.34.59.231 dc1f R Q [0580 REFUSED]
UDP response info at 00000077143B2410
Socket = 11464
Remote addr 192.34.59.231, port 53
Time Query=183354, Queued=0, Expire=0
Buf length = 0x0fa0 (4000)
Msg length = 0x000c (12)
Message:
XID 0xdc1f
Flags 0x8005
QR 1 (RESPONSE)
OPCODE 0 (QUERY)
AA 0
TC 0
RD 0
RA 0
Z 0
CD 0
AD 0
RCODE 5 (REFUSED)
QCOUNT 0
ACOUNT 0
NSCOUNT 0
ARCOUNT 0
QUESTION SECTION: empty
ANSWER SECTION: empty
AUTHORITY SECTION: empty
ADDITIONAL SECTION: empty
27/02/2020 2:16:04 PM 0B7C EVENT The DNS server encountered an invalid domain name in a packet from 192.34.59.231. The packet will be rejected. The event data contains the DNS packet.
---------------------------------------------------------
Can anyone advise what these are and how I might go about tracing where these requests are originating?
thanks
jc
