🚀 go-pugleaf

On Wed, 28 Feb 2001 19:37:45 -0800, Ray Abbitt <usenet-abuse@abbitt.org>
wrote:
>In article <3A9D3A6B.F5CC6176@mynetwatchman.com>,
>Lawrence Baldwin  <baldwinlSPAMMENOT@mynetwatchman.com> wrote:
>>
>>Our false-positive rate is remarkably low...in the last 30 days we
>>have only had ONE incident where the source provider indicated that
>>the attack was really their load-balancing servers sending DNS queries
>>to determine RTT and best route.
>>
>One question on that. Do you really consider sending repeated DNS
>queries to systems that are not listed as DNS servers (and in fact do
>not run DNS servers) anything other than abusive? Maybe the
>load-balancing software is broken, but once they know that, shouldn't
>something be done about it? (And was Microsoft the guilty party? I'm
>still getting large numbers of attempts [30000-40000 a month] on port
>53 from various Microsoft addresses.)

Are you running a caching DNS? That was part of the formula for this. I
was one of the ones involved, and am still get hits from their DNS since
midnight Sun/Mon. Usatoday.com BTW. Around 300 hits a day here, so not
as obnoxious as MS. Mostly from 2 IPs, though it started with more than
that.

-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
--