Paula Campbell wrote:
>
> Recently we had a company start surfing our DNS for every IP we own. The
> company
> called me after we reported them to the abuse line for DNS discovery traffic.
>
> The guy told me that they sell the reverse entries to marketing companys so
> they
> can tweek their web pages for their audience. We found the traffic the old
> fashion way, by looking at the logs. The guy also told me that several
> University's have parsing software that caught him right away. Can anyone
> tell
> me what they are using?
Probably something related to intrusion detection. There are numerous log
analysis
tools. You might poke through the list at:
http://www.counterpane.com/log-analysis.html
...for hints, or ask on their e-mail list. It's possible they had their
nameservers
behind a firewall and something was triggered there too.
-Robert
|
