smurfmonitor

Observing DNS abuse. Early Warning System. Security Research.

[smurfmonitor @DnsSmurf]

@_defcon_ I've seen about 4.5 Mil queries for defcon,org today see: https://t.co/04oOpYyck7 from/attacking 800+ IPs.

[smurfmonitor @DnsSmurf]

This project is not dead, dormant perhaps, just wait and see! Soon..

[smurfmonitor @DnsSmurf]

Seeing a lot of DNS AMP attacks using the domain "defcon,org" that is cool, as this year I am going to be there. @_defcon_

[smurfmonitor @DnsSmurf]

@Trojan7Sec @snowfl0w Yeah im pretty sure.

[smurfmonitor @DnsSmurf]

@snowfl0w @Trojan7Sec Itd just a dns amp against that IP.

[𝗥𝗼𝗻𝗮𝗹𝗱 𝗣𝗿𝗶𝗻𝘀 🇿🇦 @cryptoron]

Now finally people can understand the shirts we made last year. #regin

[Lennart Haagsma @lennarthaagsma]

Recently observed #NTP #amplification attacks: https://t.co/rXAwhiPj4d

[smurfmonitor @DnsSmurf]

Top domain today: nlhosting.nl - http://t.co/e3BWxbCIEQ nearly 2,000,000 query attack against 54.186.252.223 (Amazon,com)

[smurfmonitor @DnsSmurf]

Some of the DNS Amplification domains I am currently observing: https://t.co/om3FV4JjLr

[smurfmonitor @DnsSmurf]

Might have seen this attack: http://t.co/AXAUAOCKCK IP: 69.31.20.66 (Akamai) was also targetted.

[Lennart Haagsma @lennarthaagsma]

DNS Amplification Domain bmw,digmehl,cu,cc is using @cloudflare Name Servers: http://t.co/jQgv5gbhEs

[smurfmonitor @DnsSmurf]

DDOS party today - Total queries: 14,463,832 (11,550,539 displayed) (last 30 hours)

[Frank @jedisct1]

As usual, it has nothing to do with "DNS poisoning". But yes, google[.]co[.]id records were changed to send users to 167.114.12.10 (OVH)

[Frank @jedisct1]

@DnsSmurf Snapshot right now: https://t.co/W4jSpB0cud

[smurfmonitor @DnsSmurf]

@jedisct1 this exactly

[smurfmonitor @DnsSmurf]

@jedisct1 @voodooKobra dat name! You can easily search for response size?

[Lennart Haagsma @lennarthaagsma]

Interesting DNS response: http://t.co/s0yBI5FMs7 taken from: http://t.co/Qi8HHFSbUN #dns #amplification

[smurfmonitor @DnsSmurf]

@jedisct1 @voodooKobra seeing a lot less. Mostly excisting domains being abused.

[Threat Intelligence @threatintel]

#ZeroAccess operators back in action. New #clickfraud module rolled out today.