Re: strange DNS query

--===============1526721023471690220==
Content-Type: multipart/alternative; boundary="0000000000004eeb990625eab2a1"

--0000000000004eeb990625eab2a1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Hans,

as Robert explained, this is because ModSecurity has a feature (see the
blogpost).

Please note that there is an intention that we would like to stop using
this variable. It's been set to "Off" for a while, see
https://github.com/owasp-modsecurity/ModSecurity/issues/3085.

You need to update this in your config file (especially since TrustWave
transferred the project to OWASP these DNS queries don't work at all).



Thanks,


a.


On Fri, Nov 1, 2024 at 9:37=E2=80=AFPM Hans Mayer via mod-security-users <
[email protected]> wrote:

>
> Dear All,
>
> I am using Apache/2.4.62 on Debian with the modsecurity-crs package
> which is Producer ModSecurity for Apache/2.9.7 and Rule Set
> OWASP_CRS/4.9.0-dev
>
> Each time I restart Apache I find a strange log entry in BINDs query log.
> The system is looking for a name
>
> GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLR=
RGQWGGMY.1730491019.status.modsecurity.org
> as A resource record which does not exists.
> The query is almost the same except the number ( 1730491019 ) wich is
> the Unix time.
> Also this string GIXDSLRRGQWGGMY is different on different servers.
>
> Any idea for what this should be useful ? Does it make sense ?
> Which part is actually doing this ?
>
> Kind regards
> Hans
>
> --
>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

--0000000000004eeb990625eab2a1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi Hans,</div><div><br></div><div>as Robert explained=
, this is because ModSecurity has a feature (see the blogpost).</div><div><=
br></div><div>Please note that there is an intention that we would like to =
stop using this variable. It&#39;s been set to &quot;Off&quot; for a while,=
 see=C2=A0<a href=3D"https://github.com/owasp-modsecurity/ModSecurity/issue=
s/3085">https://github.com/owasp-modsecurity/ModSecurity/issues/3085</a>.</=
div><div><br></div><div>You need to update this in your config file (especi=
ally since TrustWave transferred the project to OWASP these DNS queries don=
&#39;t work at all).</div><div><br></div><div><br></div><div><br></div><div=
>Thanks,</div><div><br></div><div><br></div><div>a.</div><div><br> </div></=
div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On=
 Fri, Nov 1, 2024 at 9:37=E2=80=AFPM Hans Mayer via mod-security-users &lt;=
<a href=3D"mailto:[email protected]">mod-security-us=
[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmai=
l_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,20=
4,204);padding-left:1ex"><br>
Dear All,<br>
<br>
I am using Apache/2.4.62 on Debian with the modsecurity-crs package <br>
which is Producer ModSecurity for Apache/2.9.7 and Rule Set=C2=A0 <br>
OWASP_CRS/4.9.0-dev<br>
<br>
Each time I restart Apache I find a strange log entry in BINDs query log.<b=
r>
The system is looking for a name<br>
<a href=3D"http://GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LB=
EA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org" rel=3D"noreferr=
er" target=3D"_blank">GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WE=
Y5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org</a><br>
as A resource record which does not exists.<br>
The query is almost the same except the number ( 1730491019 ) wich is <br>
the Unix time.<br>
Also this string GIXDSLRRGQWGGMY is different on different servers.<br>
<br>
Any idea for what this should be useful ? Does it make sense ?<br>
Which part is actually doing this ?<br>
<br>
Kind regards<br>
Hans<br>
<br>
-- <br>
<br>
<br>
<br>
_______________________________________________<br>
mod-security-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blan=
k">[email protected]</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-users"=
 rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l=
istinfo/mod-security-users</a><br>
Commercial ModSecurity Rules and Support from Trustwave&#39;s SpiderLabs:<b=
r>
<a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=3D"no=
referrer" target=3D"_blank">http://www.modsecurity.org/projects/commercial/=
rules/</a><br>
<a href=3D"http://www.modsecurity.org/projects/commercial/support/" rel=3D"=
noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/commercia=
l/support/</a><br>
</blockquote></div>

--0000000000004eeb990625eab2a1--


--===============1526721023471690220==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1526721023471690220==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

--===============1526721023471690220==--