Friday, August 23, 2013

Domain: srvit.org

Seen a scan for this domain on a passive box.

Source:


80.82.65.204 AS29073 Ecatel Network (again!)

Response:


151 A records in the 123.45.67.x range.

IPtables rule:


iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x05535256 && 0x2c&0xDFDFFFDF=0x4954034f && 0x30&0xDFDFFFFF=0x52470000" -j DROP -m comment --comment "DROP DNS Q srvit.org"

More rules here

Name servers:


;; ANSWER SECTION:
srvit.org. 3600 IN NS ns2.srvit.org.
srvit.org. 3600 IN NS ns1.srvit.org.

;; ADDITIONAL SECTION:
ns2.srvit.org. 7200 IN A 94.102.56.221
ns1.srvit.org. 7200 IN A 94.102.56.221


Whois:



Domain ID:D169062038-LROR
Domain Name:SRVIT.ORG
Created On:26-Jun-2013 16:56:01 UTC
Last Updated On:26-Jun-2013 21:55:11 UTC
Expiration Date:26-Jun-2014 16:56:01 UTC
Sponsoring Registrar:Internet.bs Corp. (R1601-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:INTEym178v8dv1hm
Registrant Name:Domain Administrator
Registrant Organization:Fundacion Private Whois
Registrant Street1:Attn: srvit.org
Registrant Street2:Aptds. 0850-00056
Registrant Street3:
Registrant City:Panama
Registrant State/Province:
Registrant Postal Code:Zona 15
Registrant Country:PA
Registrant Phone:+507.65995877
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:51cb1d1exo492kj9@t02cduv4f7f99a255f64.privatewhois.net
Admin ID:INTEtxgnkjb9l6o0
Admin Name:Domain Administrator
Admin Organization:Fundacion Private Whois
Admin Street1:Attn: srvit.org
Admin Street2:Aptds. 0850-00056
Admin Street3:
Admin City:Panama
Admin State/Province:
Admin Postal Code:Zona 15
Admin Country:PA
Admin Phone:+507.65995877
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:51cb1d1fi7enxtvo@t02cduv4f7f99a255f64.privatewhois.net
Tech ID:INTEi280uqbcqb3i
Tech Name:Domain Administrator
Tech Organization:Fundacion Private Whois
Tech Street1:Attn: srvit.org
Tech Street2:Aptds. 0850-00056
Tech Street3:
Tech City:Panama
Tech State/Province:
Tech Postal Code:Zona 15
Tech Country:PA
Tech Phone:+507.65995877
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:51cb1d1efycum495@t02cduv4f7f99a255f64.privatewhois.net
Name Server:NS1.SRVIT.ORG
Name Server:NS2.SRVIT.ORG
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC:Unsigned








No comments:

Post a Comment