Open DNS recursors on Sonic.net /24 block

[kevinburke]

Hi,
I've been reading more about the DDOS attack on Spamhaus that's been affecting Internet traffic in Europe for the past few days. A key feature of the attack is its use of DNS amplification, eg open DNS recursors that amplify DNS queries and give an attacker access to orders of magnitude more bandwidth than they had access to before. There's more information here: http://blog.cloudflare.com/the-ddos-tha ... e-internet

Searching my /24 subblock on Sonic.net reveals seven open DNS recursors in this IP block, as found here: http://openresolverproject.org/search.c ... r=50.0.204

Is it possible to reach out to the maintainers of these and ask them to be closed, or only return responses to queries from Sonic IP's?

Best,
Kevin

[Guest]

Pretty sure it's being worked on. viewtopic.php?f=5&t=1186&start=50#p7297

They reopened it for some reason.

[aw]

Different issues. kevinburke is talking about Sonic customers running their own DNS recursors. On that list, I was only able to querey 50.0.204.48 from off sonic's network.

[kevinburke]

Any update here?

[adame]

We've contacted the owner of the IP address mentioned and made them aware of the vulnerability.