Randy, thanks for sharing, I didn't know this is actually done. Any idea if they use something clever or just exhaustive search? thanks Amir

Amir Herzberg

Comcast professor of Security Innovations, Computer Science and Engineering, University of Connecticut

Homepage: https://sites.google.com/site/amirherzberg/home

`Applied Introduction to Cryptography' textbook and lectures:https://sites.google.com/site/amirherzberg/cybersecurity

On Tue, Oct 31, 2023 at 6:49 PM Randy Bush <randy@psg.com> wrote:

i have blocked a zone enumerator, though i guess they will be a
whack-a-mole

others have reported them as well

/home/randy> sudo tcpdump -pni vtnet0 -c 10 port 53 and net 193.235.141
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vtnet0, link-type EN10MB (Ethernet), capture size 262144 bytes
22:42:39.516849 IP 193.235.141.90.32768 > 666.42.7.11.53: 14 NS? 33j4h.org.al. (30)
22:42:39.517640 IP 193.235.141.17.32768 > 666.42.7.11.53: 14 NS? 33m6d.xn--mgbayh7gpa. (38)
22:42:39.519169 IP 193.235.141.17.32768 > 666.42.7.11.53: 14 NS? 33lxd.tn. (26)
22:42:39.520064 IP 193.235.141.171.32768 > 666.42.7.11.53: 14 NS? 33md6.jo. (26)
22:42:39.521081 IP 193.235.141.247.32768 > 666.42.7.11.53: 14 NS? 33lxd.lb. (26)
22:42:39.523981 IP 193.235.141.162.32768 > 666.42.7.11.53: 14 NS? 33pd2.az. (26)
22:42:39.525043 IP 193.235.141.60.32768 > 666.42.7.11.53: 14 NS? 33nc5.com.al. (30)
22:42:39.526185 IP 193.235.141.209.32768 > 666.42.7.11.53: 14 NS? 33nc5.sz. (26)
22:42:39.527931 IP 193.235.141.150.32768 > 666.42.7.11.53: 14 NS? 33q5p.com.al. (30)
22:42:39.529516 IP 193.235.141.210.32768 > 666.42.7.11.53: 14 NS? 33qbq.com.al. (30)
10 packets captured
124 packets received by filter
0 packets dropped by kernel

inetnum: 193.235.141.0 - 193.235.141.255
netname: domaincrawler-hosting
descr: domaincrawler hosting
org: ORG-ABUS1196-RIPE
country: SE
admin-c: VIJE1-RIPE
tech-c: VIJE1-RIPE
status: ASSIGNED PA
notify: c+1196@resilans.se
mnt-by: RESILANS-MNT
mnt-routes: ETTNET-LIR
created: 2008-04-03T11:21:00Z
last-modified: 2017-04-10T12:47:06Z
source: RIPE

randy