I have encountered an issue that has been puzzling me for several time. Hopefully someone will help me understand what is happening or point in right direction.
One of my servers (CentOS 6.x) started sending massive DNS requests to our DNS provider, causing DoS alerts.
As stated from the DNS provider, 239000 queries/5min were sent.
Log sample (CentOS is 2xx.2xx.2xx.2xx , DNS is 1xx.1xx.1xx.1xx):
29-Oct-2013 21:24:08.444 queries: client 2xx.2xx.2xx.2xx#38597: view internal: query: boot.servequake.com IN A + (1xx.1xx.1xx.1xx)
29-Oct-2013 21:24:08.445 queries: client 2xx.2xx.2xx.2xx#60776: view internal: query: boot.servequake.com IN A + (1xx.1xx.1xx.1xx)
29-Oct-2013 21:24:08.446 queries: client 2xx.2xx.2xx.2xx#46437: view internal: query: boot.servequake.com IN A + (1xx.1xx.1xx.1xx)
Actions taken on my Server: Logged and blocked all requests to the DNS servers using IPtables, added "0.0.0.0 boot.servequake.com" to hosts and presently it generates 1375 entries/5min. Couldn't find any evidence of exploit in the server.
This CentOS server is running multiple apps and has a public IP. At first, the reason could be an app malfunction or some intentional DoS attack using my server as "zombie". I simply searched for "boot.servequake.com" (to understand why this adress resolution is being requested) and i got very few and useless results in our favourite search engine. Also tested ping and traceroute for boot.servequake.com and it resolves to 0.0.0.0 with no hops. This happens in all CentOS servers, CentOS VM's, Ubuntu workstations, but not in the affected server.
- Is "boot.servequake.com" some sort of an alias of 0.0.0.0 included in this Linux distros?
- If so, why can't I find any info about it online?
- Where could I find this configuration?(its not in hosts file)
- Why is a .servequake.com (property of no-ip.com) being used in all the tested Linux machines?
Thanks in Advance
EDIT: corrected "localhost" to "0.0.0.0"