Domain: la2low.cc

Seen a scan on the 6th for this domain and first attacks on the 7th.

Source:

06-Sep-2013 13:24 client 80.82.70.239 : query: la2low.cc IN A +E

AS29073 ECATEL-AS

Seen before:

      2 evgeniy-marchenko.cc
      1 qha.cc
      1 la2low.cc

Response:

A records in the 204.46.43.x range

IPtables rule:

iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFFF=0x064c4132 && 0x2c&0xDFDFDFFF=0x4c4f5702 && 0x30&0xDFDFFFFF=0x43430000" -j DROP -m comment --comment "DROP DNS Q la2low.cc"

More rules here

Name servers:

;; ANSWER SECTION:
la2low.cc.              2599    IN      NS      b.dns.gandi.net.
la2low.cc.              2599    IN      NS      a.dns.gandi.net.

la2low.cc.              2599    IN      NS      c.dns.gandi.net.

Whois:

domain: la2low.cc
reg_created: 2013-09-06 09:03:27
expires: 2014-09-06 09:03:27
created: 2013-09-06 11:03:28
changed: 2013-09-06 11:13:09
transfer-prohibited: yes
ns0: a.dns.gandi.net
ns1: b.dns.gandi.net
ns2: c.dns.gandi.net
owner-c:
  nic-hdl: XX9170-GANDI
  owner-name: Евгений Плющенко
  organisation: ~
  person: Евгений Плющенко
  address: ул.Ленинина д.20
  zipcode: 123456
  city: Киров
  country: Russia
  phone: +7.9200485462
  fax: ~
  email: b779e9571dc66a7b1ab8f7c446df05f5-1775596@contact.gandi.net
  lastupdated: 2013-09-06 10:45:49
admin-c:
  nic-hdl: XX9170-GANDI
  owner-name: Евгений Плющенко
  organisation: ~
  person: Евгений Плющенко
  address: ул.Ленинина д.20
  zipcode: 123456
  city: Киров
  country: Russia
  phone: +7.9200485462
  fax: ~
  email: b779e9571dc66a7b1ab8f7c446df05f5-1775596@contact.gandi.net
  lastupdated: 2013-09-06 10:45:49
tech-c:
  nic-hdl: XX9170-GANDI
  owner-name: Евгений Плющенко
  organisation: ~
  person: Евгений Плющенко
  address: ул.Ленинина д.20
  zipcode: 123456
  city: Киров
  country: Russia
  phone: +7.9200485462
  fax: ~
  email: b779e9571dc66a7b1ab8f7c446df05f5-1775596@contact.gandi.net
  lastupdated: 2013-09-06 10:45:49
bill-c:
  nic-hdl: XX9170-GANDI
  owner-name: Евгений Плющенко
  organisation: ~
  person: Евгений Плющенко
  address: ул.Ленинина д.20
  zipcode: 123456
  city: Киров
  country: Russia
  phone: +7.9200485462
  fax: ~
  email: b779e9571dc66a7b1ab8f7c446df05f5-1775596@contact.gandi.net
  lastupdated: 2013-09-06 10:45:49