With the remote packets having a source port of 53, one of four things is usually the case:
- You were given IP addresses that were previously used by devices with a listening port 53, and devices who knew about it in the past are still trying to use it. (could have been an authoritative server or an open resolver)
- Your devices are participating in an attack.
- These packets are being reflected onto you and you are the target of the attack, as you are suspecting.
- These packets are being reflected onto you and you are not the target of the attack. Your IP just happens to be the one they're faking.
Lots of people mistake #1 to be an attack on their server (#3). You have to look at the amount of incoming traffic to gauge, and since you aren't complaining about your bandwidth being choked by this it's unlikely. Let's rule #3 out.
Our next hint is the query name:
tnczmz.x99moyu.net. Names like this are familiar to anyone who has operated high volume recursive DNS servers in the last few years (and have been paying attention): this is a "Pseudo Random Subdomain" aka "Water Torture" attack. I won't get into exhaustive detail here, but the idea is to generate thousands of uncacheable random queries under a domain so that all the requests are sent up to the nameservers for that domain, the true victim of the attack. In this case they're the nameservers for Cloudflare:
$ dig +short x99moyu.net NS
Since I'm pretty sure you aren't a server admin for Cloudflare, we now need to consider the direction of the packets in order to rule out #1. Here's what we have to work with:
- Source: 18.104.22.168 (China)
- Source Port: 53
- Destination: Your Server
- Destination Port: Random
A Chinese IP is sending you DNS reply packets. We know they're reply packets because they contain a DNS answer section. Since neither you or this remote IP are owned by Cloudflare (their nameservers manage the domain), we can assume that one of these IPs is spoofed. Given the victim of the attack (Cloudflare) and how the attack operates, the address most likely being spoofed here is yours. That would make the Chinese IP a server that is receiving the recursive queries.
My conclusion is that you are neither the target of the attack or participating in the attack (which is the case more often than not, you got lucky). This is a case of #4: your source IP is just getting spoofed as a part of someone else covering their trail while performing an attack against Cloudflare.
In hindsight, #2 is still a possibility. Even if the server holding your IP does not provide a DNS listener, your server could be compromised and running malware that is generating the queries. This assumes that your packet capture is overlooking the outbound queries, of course. (it dawned on me that it's bad to assume that this would have been noticed)