Re: strange DNS query

--===============7130158865556607380==
Content-Type: multipart/alternative; boundary="00000000000090e3740625e01b5c"

--00000000000090e3740625e01b5c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Looks like this has been around for quite a while:

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing=
-modsecurity-status-reporting/

Sincerely,
Robert Paprocki
c. 949.345.5709


On Fri, Nov 1, 2024 at 1:36=E2=80=AFPM Hans Mayer via mod-security-users <
[email protected]> wrote:

>
> Dear All,
>
> I am using Apache/2.4.62 on Debian with the modsecurity-crs package
> which is Producer ModSecurity for Apache/2.9.7 and Rule Set
> OWASP_CRS/4.9.0-dev
>
> Each time I restart Apache I find a strange log entry in BINDs query log.
> The system is looking for a name
>
> GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLR=
RGQWGGMY.1730491019.status.modsecurity.org
> as A resource record which does not exists.
> The query is almost the same except the number ( 1730491019 ) wich is
> the Unix time.
> Also this string GIXDSLRRGQWGGMY is different on different servers.
>
> Any idea for what this should be useful ? Does it make sense ?
> Which part is actually doing this ?
>
> Kind regards
> Hans
>
> --
>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

--00000000000090e3740625e01b5c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Looks like this has been around for quite a while:<div><br=
></div><div><a href=3D"https://www.trustwave.com/en-us/resources/blogs/spid=
erlabs-blog/introducing-modsecurity-status-reporting/">https://www.trustwav=
e.com/en-us/resources/blogs/spiderlabs-blog/introducing-modsecurity-status-=
reporting/</a><br clear=3D"all"><div><div dir=3D"ltr" class=3D"gmail_signat=
ure" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div style=3D"colo=
r:rgb(34,34,34)"><br></div><div style=3D"color:rgb(34,34,34)">Sincerely,</d=
iv><div style=3D"color:rgb(34,34,34)">Robert Paprocki</div><div style=3D"co=
lor:rgb(34,34,34)">c. 949.345.5709</div></div></div></div><br></div></div><=
br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri,=
 Nov 1, 2024 at 1:36=E2=80=AFPM Hans Mayer via mod-security-users &lt;<a hr=
ef=3D"mailto:[email protected]">mod-security-users@l=
ists.sourceforge.net</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quo=
te" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204=
);padding-left:1ex"><br>
Dear All,<br>
<br>
I am using Apache/2.4.62 on Debian with the modsecurity-crs package <br>
which is Producer ModSecurity for Apache/2.9.7 and Rule Set=C2=A0 <br>
OWASP_CRS/4.9.0-dev<br>
<br>
Each time I restart Apache I find a strange log entry in BINDs query log.<b=
r>
The system is looking for a name<br>
<a href=3D"http://GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LB=
EA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org" rel=3D"noreferr=
er" target=3D"_blank">GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WE=
Y5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org</a><br>
as A resource record which does not exists.<br>
The query is almost the same except the number ( 1730491019 ) wich is <br>
the Unix time.<br>
Also this string GIXDSLRRGQWGGMY is different on different servers.<br>
<br>
Any idea for what this should be useful ? Does it make sense ?<br>
Which part is actually doing this ?<br>
<br>
Kind regards<br>
Hans<br>
<br>
-- <br>
<br>
<br>
<br>
_______________________________________________<br>
mod-security-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blan=
k">[email protected]</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-users"=
 rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l=
istinfo/mod-security-users</a><br>
Commercial ModSecurity Rules and Support from Trustwave&#39;s SpiderLabs:<b=
r>
<a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=3D"no=
referrer" target=3D"_blank">http://www.modsecurity.org/projects/commercial/=
rules/</a><br>
<a href=3D"http://www.modsecurity.org/projects/commercial/support/" rel=3D"=
noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/commercia=
l/support/</a><br>
</blockquote></div>

--00000000000090e3740625e01b5c--


--===============7130158865556607380==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============7130158865556607380==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

--===============7130158865556607380==--