On 9/23/2013 9:55 AM, Christopher Hunt wrote:
Beginning about 0900UTC we began seeing about 50x our usual DNS traffic.
75% of the traffic is for d6991.com. Does anyone else see this? Who are
these folks (WEBNIC.CC)?
Maybe because of this mess?
;; Truncated, retrying in TCP mode.
; <<>> DiG 9.7.3 <<>> @localhost d6991.com A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61549
;; flags: qr rd ra; QUERY: 1, ANSWER: 256, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;d6991.com. IN A
;; ANSWER SECTION:
d6991.com. 6000 IN A 121.100.153.100
d6991.com. 6000 IN A 121.100.153.101
d6991.com. 6000 IN A 121.100.153.102
d6991.com. 6000 IN A 121.100.153.103
d6991.com. 6000 IN A 121.100.153.104
d6991.com. 6000 IN A 121.100.153.105
d6991.com. 6000 IN A 121.100.153.106
d6991.com. 6000 IN A 121.100.153.107
d6991.com. 6000 IN A 121.100.153.108
d6991.com. 6000 IN A 121.100.153.109
d6991.com. 6000 IN A 121.100.153.110
d6991.com. 6000 IN A 121.100.153.111
d6991.com. 6000 IN A 121.100.153.112
d6991.com. 6000 IN A 121.100.153.113
d6991.com. 6000 IN A 121.100.153.114
d6991.com. 6000 IN A 121.100.153.115
d6991.com. 6000 IN A 121.100.153.116
d6991.com. 6000 IN A 121.100.153.117
d6991.com. 6000 IN A 121.100.153.118
d6991.com. 6000 IN A 121.100.153.119
d6991.com. 6000 IN A 121.100.153.120
d6991.com. 6000 IN A 121.100.153.121
d6991.com. 6000 IN A 121.100.153.122
d6991.com. 6000 IN A 121.100.153.123
d6991.com. 6000 IN A 121.100.153.124
d6991.com. 6000 IN A 121.100.153.125
d6991.com. 6000 IN A 121.100.153.126
d6991.com. 6000 IN A 121.100.153.127
d6991.com. 6000 IN A 121.100.153.128
d6991.com. 6000 IN A 121.100.153.129
d6991.com. 6000 IN A 121.100.153.130
d6991.com. 6000 IN A 121.100.153.131
d6991.com. 6000 IN A 121.100.153.132
d6991.com. 6000 IN A 121.100.153.133
d6991.com. 6000 IN A 121.100.153.134
d6991.com. 6000 IN A 121.100.153.135
d6991.com. 6000 IN A 121.100.153.136
d6991.com. 6000 IN A 121.100.153.137
d6991.com. 6000 IN A 121.100.153.138
d6991.com. 6000 IN A 121.100.153.139
d6991.com. 6000 IN A 121.100.153.140
d6991.com. 6000 IN A 121.100.153.141
d6991.com. 6000 IN A 121.100.153.142
d6991.com. 6000 IN A 121.100.153.143
d6991.com. 6000 IN A 121.100.153.144
d6991.com. 6000 IN A 121.100.153.145
d6991.com. 6000 IN A 121.100.153.146
d6991.com. 6000 IN A 121.100.153.147
d6991.com. 6000 IN A 121.100.153.148
d6991.com. 6000 IN A 121.100.153.149
d6991.com. 6000 IN A 121.100.153.150
d6991.com. 6000 IN A 121.100.153.151
d6991.com. 6000 IN A 121.100.153.152
d6991.com. 6000 IN A 121.100.153.153
d6991.com. 6000 IN A 121.100.153.154
d6991.com. 6000 IN A 121.100.153.155
d6991.com. 6000 IN A 121.100.153.156
d6991.com. 6000 IN A 121.100.153.157
d6991.com. 6000 IN A 121.100.153.158
d6991.com. 6000 IN A 121.100.153.159
d6991.com. 6000 IN A 121.100.153.160
d6991.com. 6000 IN A 121.100.153.161
d6991.com. 6000 IN A 121.100.153.162
d6991.com. 6000 IN A 121.100.153.163
d6991.com. 6000 IN A 121.100.153.164
d6991.com. 6000 IN A 121.100.153.165
d6991.com. 6000 IN A 121.100.153.166
d6991.com. 6000 IN A 121.100.153.167
d6991.com. 6000 IN A 121.100.153.168
d6991.com. 6000 IN A 121.100.153.169
d6991.com. 6000 IN A 121.100.153.170
d6991.com. 6000 IN A 121.100.153.171
d6991.com. 6000 IN A 121.100.153.172
d6991.com. 6000 IN A 121.100.153.173
d6991.com. 6000 IN A 121.100.153.174
d6991.com. 6000 IN A 121.100.153.175
d6991.com. 6000 IN A 121.100.153.176
d6991.com. 6000 IN A 121.100.153.177
d6991.com. 6000 IN A 121.100.153.178
d6991.com. 6000 IN A 121.100.153.179
d6991.com. 6000 IN A 121.100.153.180
d6991.com. 6000 IN A 121.100.153.181
d6991.com. 6000 IN A 121.100.153.182
d6991.com. 6000 IN A 121.100.153.183
d6991.com. 6000 IN A 121.100.153.184
d6991.com. 6000 IN A 121.100.153.185
d6991.com. 6000 IN A 121.100.153.186
d6991.com. 6000 IN A 121.100.153.187
d6991.com. 6000 IN A 121.100.153.188
d6991.com. 6000 IN A 121.100.153.189
d6991.com. 6000 IN A 121.100.153.190
d6991.com. 6000 IN A 121.100.153.191
d6991.com. 6000 IN A 121.100.153.192
d6991.com. 6000 IN A 121.100.153.193
d6991.com. 6000 IN A 121.100.153.194
d6991.com. 6000 IN A 121.100.153.195
d6991.com. 6000 IN A 121.100.153.196
d6991.com. 6000 IN A 121.100.153.197
d6991.com. 6000 IN A 121.100.153.198
d6991.com. 6000 IN A 121.100.153.199
d6991.com. 6000 IN A 121.100.153.200
d6991.com. 6000 IN A 121.100.152.100
d6991.com. 6000 IN A 121.100.152.101
d6991.com. 6000 IN A 121.100.152.102
d6991.com. 6000 IN A 121.100.152.103
d6991.com. 6000 IN A 121.100.152.104
d6991.com. 6000 IN A 121.100.152.105
d6991.com. 6000 IN A 121.100.152.106
d6991.com. 6000 IN A 121.100.152.107
d6991.com. 6000 IN A 121.100.152.108
d6991.com. 6000 IN A 121.100.152.109
d6991.com. 6000 IN A 121.100.152.110
d6991.com. 6000 IN A 121.100.152.111
d6991.com. 6000 IN A 121.100.152.112
d6991.com. 6000 IN A 121.100.152.113
d6991.com. 6000 IN A 121.100.152.114
d6991.com. 6000 IN A 121.100.152.115
d6991.com. 6000 IN A 121.100.152.116
d6991.com. 6000 IN A 121.100.152.117
d6991.com. 6000 IN A 121.100.152.118
d6991.com. 6000 IN A 121.100.152.119
d6991.com. 6000 IN A 121.100.152.120
d6991.com. 6000 IN A 121.100.152.121
d6991.com. 6000 IN A 121.100.152.122
d6991.com. 6000 IN A 121.100.152.123
d6991.com. 6000 IN A 121.100.152.124
d6991.com. 6000 IN A 121.100.152.125
d6991.com. 6000 IN A 121.100.152.126
d6991.com. 6000 IN A 121.100.152.127
d6991.com. 6000 IN A 121.100.152.128
d6991.com. 6000 IN A 121.100.152.129
d6991.com. 6000 IN A 121.100.152.130
d6991.com. 6000 IN A 121.100.152.131
d6991.com. 6000 IN A 121.100.152.132
d6991.com. 6000 IN A 121.100.152.133
d6991.com. 6000 IN A 121.100.152.134
d6991.com. 6000 IN A 121.100.152.135
d6991.com. 6000 IN A 121.100.152.136
d6991.com. 6000 IN A 121.100.152.137
d6991.com. 6000 IN A 121.100.152.138
d6991.com. 6000 IN A 121.100.152.139
d6991.com. 6000 IN A 121.100.152.140
d6991.com. 6000 IN A 121.100.152.141
d6991.com. 6000 IN A 121.100.152.142
d6991.com. 6000 IN A 121.100.152.143
d6991.com. 6000 IN A 121.100.152.144
d6991.com. 6000 IN A 121.100.152.145
d6991.com. 6000 IN A 121.100.152.146
d6991.com. 6000 IN A 121.100.152.147
d6991.com. 6000 IN A 121.100.152.148
d6991.com. 6000 IN A 121.100.152.149
d6991.com. 6000 IN A 121.100.152.150
d6991.com. 6000 IN A 121.100.152.151
d6991.com. 6000 IN A 121.100.152.152
d6991.com. 6000 IN A 121.100.152.153
d6991.com. 6000 IN A 121.100.152.154
d6991.com. 6000 IN A 121.100.152.155
d6991.com. 6000 IN A 121.100.152.156
d6991.com. 6000 IN A 121.100.152.157
d6991.com. 6000 IN A 121.100.152.158
d6991.com. 6000 IN A 121.100.152.159
d6991.com. 6000 IN A 121.100.152.160
d6991.com. 6000 IN A 121.100.152.161
d6991.com. 6000 IN A 121.100.152.162
d6991.com. 6000 IN A 121.100.152.163
d6991.com. 6000 IN A 121.100.152.164
d6991.com. 6000 IN A 121.100.152.165
d6991.com. 6000 IN A 121.100.152.166
d6991.com. 6000 IN A 121.100.152.167
d6991.com. 6000 IN A 121.100.152.168
d6991.com. 6000 IN A 121.100.152.169
d6991.com. 6000 IN A 121.100.152.170
d6991.com. 6000 IN A 121.100.152.171
d6991.com. 6000 IN A 121.100.152.172
d6991.com. 6000 IN A 121.100.152.173
d6991.com. 6000 IN A 121.100.152.174
d6991.com. 6000 IN A 121.100.152.175
d6991.com. 6000 IN A 121.100.152.176
d6991.com. 6000 IN A 121.100.152.177
d6991.com. 6000 IN A 121.100.152.178
d6991.com. 6000 IN A 121.100.152.179
d6991.com. 6000 IN A 121.100.152.180
d6991.com. 6000 IN A 121.100.152.181
d6991.com. 6000 IN A 121.100.152.182
d6991.com. 6000 IN A 121.100.152.183
d6991.com. 6000 IN A 121.100.152.184
d6991.com. 6000 IN A 121.100.152.185
d6991.com. 6000 IN A 121.100.152.186
d6991.com. 6000 IN A 121.100.152.187
d6991.com. 6000 IN A 121.100.152.188
d6991.com. 6000 IN A 121.100.152.189
d6991.com. 6000 IN A 121.100.152.190
d6991.com. 6000 IN A 121.100.152.191
d6991.com. 6000 IN A 121.100.152.192
d6991.com. 6000 IN A 121.100.152.193
d6991.com. 6000 IN A 121.100.152.194
d6991.com. 6000 IN A 121.100.152.195
d6991.com. 6000 IN A 121.100.152.196
d6991.com. 6000 IN A 121.100.152.197
d6991.com. 6000 IN A 121.100.152.198
d6991.com. 6000 IN A 121.100.152.199
d6991.com. 6000 IN A 121.100.152.200
d6991.com. 6000 IN A 121.100.152.201
d6991.com. 6000 IN A 121.100.152.202
d6991.com. 6000 IN A 121.100.152.203
d6991.com. 6000 IN A 121.100.152.204
d6991.com. 6000 IN A 121.100.152.205
d6991.com. 6000 IN A 121.100.152.206
d6991.com. 6000 IN A 121.100.152.207
d6991.com. 6000 IN A 121.100.152.208
d6991.com. 6000 IN A 121.100.152.209
d6991.com. 6000 IN A 121.100.152.210
d6991.com. 6000 IN A 121.100.152.211
d6991.com. 6000 IN A 121.100.152.212
d6991.com. 6000 IN A 121.100.152.213
d6991.com. 6000 IN A 121.100.152.214
d6991.com. 6000 IN A 121.100.152.215
d6991.com. 6000 IN A 121.100.152.216
d6991.com. 6000 IN A 121.100.152.217
d6991.com. 6000 IN A 121.100.152.218
d6991.com. 6000 IN A 121.100.152.219
d6991.com. 6000 IN A 121.100.152.220
d6991.com. 6000 IN A 121.100.152.221
d6991.com. 6000 IN A 121.100.152.222
d6991.com. 6000 IN A 121.100.152.223
d6991.com. 6000 IN A 121.100.152.224
d6991.com. 6000 IN A 121.100.152.225
d6991.com. 6000 IN A 121.100.152.226
d6991.com. 6000 IN A 121.100.152.227
d6991.com. 6000 IN A 121.100.152.228
d6991.com. 6000 IN A 121.100.152.229
d6991.com. 6000 IN A 121.100.152.230
d6991.com. 6000 IN A 121.100.152.231
d6991.com. 6000 IN A 121.100.152.232
d6991.com. 6000 IN A 121.100.152.233
d6991.com. 6000 IN A 121.100.152.234
d6991.com. 6000 IN A 121.100.152.235
d6991.com. 6000 IN A 121.100.152.236
d6991.com. 6000 IN A 121.100.152.237
d6991.com. 6000 IN A 121.100.152.238
d6991.com. 6000 IN A 121.100.152.239
d6991.com. 6000 IN A 121.100.152.240
d6991.com. 6000 IN A 121.100.152.241
d6991.com. 6000 IN A 121.100.152.242
d6991.com. 6000 IN A 121.100.152.243
d6991.com. 6000 IN A 121.100.152.244
d6991.com. 6000 IN A 121.100.152.245
d6991.com. 6000 IN A 121.100.152.246
d6991.com. 6000 IN A 121.100.152.247
d6991.com. 6000 IN A 121.100.152.248
d6991.com. 6000 IN A 121.100.152.249
d6991.com. 6000 IN A 121.100.152.250
d6991.com. 6000 IN A 121.100.152.251
d6991.com. 6000 IN A 121.100.152.252
d6991.com. 6000 IN A 121.100.152.253
d6991.com. 6000 IN A 121.100.152.254
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Sep 23 19:06:40 2013
;; MSG SIZE rcvd: 4123
% [whois.apnic.net]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
% Information related to '121.100.128.0 - 121.100.191.255'
inetnum: 121.100.128.0 - 121.100.191.255
netname: YanYang-network
descr: Beijing Yan Yang Century Science & Technology Co., LTD
descr: 9-605 Xuhuiaodu, Lishuiqiao south, Chaoyang District,
Beijing
country: CN
admin-c: ZM675-AP
tech-c: ZM676-AP
mnt-by: MAINT-CNNIC-AP
mnt-lower: MAINT-CNNIC-AP
mnt-routes: MAINT-CNNIC-AP
mnt-irt: IRT-CNNIC-CN
status: ALLOCATED PORTABLE
changed: i...@cnnic.net 20110610
source: APNIC
irt: IRT-CNNIC-CN
address: Beijing, China
e-mail: i...@cnnic.cn
abuse-mailbox: i...@cnnic.cn
admin-c: IP50-AP
tech-c: IP50-AP
auth: # Filtered
remarks: Please note that CNNIC is not an ISP and is not
remarks: empowered to investigate complaints of network abuse.
remarks: Please contact the tech-c or admin-c of the network.
mnt-by: MAINT-CNNIC-AP
changed: i...@cnnic.cn 20110428
source: APNIC
person: Yanqing Xiao
address: 9-605 Xuhuiaodu. Lishuiqiao south Chaoyang District
address: Beijing, China, 100012
country: CN
phone: +86-18600090096
fax-no: +86-010- 59456518
e-mail: xiaoyanqin...@126.com
nic-hdl: ZM675-AP
mnt-by: MAINT-CNNIC-AP
changed: i...@cnnic.net 20110609
source: APNIC
person: Jian Zhou
address: 9-605 Xuhuiaodu. Lishuiqiao south Chaoyang District
address: Beijing, China, 100012
country: CN
phone: +86-18611086106
fax-no: +86-010- 59456518
e-mail: sxb...@163.com
nic-hdl: ZM676-AP
mnt-by: MAINT-CNNIC-AP
changed: i...@cnnic.net 20110609
source: APNIC
% Information related to '121.100.128.0/19AS4837'
route: 121.100.128.0/19
descr: CNC Group CHINA169 Shan1xi Province Network
descr: Addresses from CNNIC
country: CN
origin: AS4837
mnt-by: MAINT-CNCGROUP-RR
changed: ab...@cnc-noc.net 20060926
source: APNIC
% This query was served by the APNIC Whois Service version 1.68 (WHOIS3)
- ferg
--
Paul Ferguson
Vice President, Threat Intelligence
Internet Identity, Tacoma, Washington USA
IID --> "Connect and Collaborate" --> www.internetidentity.com
