RE: [sentinix-list] Anyone ever heard of darkprofits.net ordarkprofits.com?

More than likely those requests are coming from machines infected with
Mimail, how to stop it... I would need to know more about your DNS server and
environment.  

Sounds like you have the same server responding to queries for internal and
external.  If it's BIND you could set it to respond only for zones for which
it is authoritative, however that would break internal requests, unless you
are running 2 nics

See if this helps http://www.zytrax.com/books/dns/ch4/#stealth

Travis Albrecht

-----Original Message-----
From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
[mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org] On Behalf Of
Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected]
Sent: Monday, February 02, 2004 1:00 PM
To: The SENTINIX Mailing List
Subject: [sentinix-list] Anyone ever heard of darkprofits.net
ordarkprofits.com?






Hi guys. I know this is the Sentinix mailing list but i am just wondering
if i could get some help here. I found that my DNS server is being asked to
make numerous resolutions of darkprofits.com and darkrpofits.net. None of
my internal clients are making these requests. My Sniffer shows me that the
requests are being made from outside my network and that my DNS server is
making a request for this domain to external hosts. Does anyone know where
this may be coming from and how to stop it?


Regards


_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix