Description
This analysis discusses a large-scale domain name system (DNS) probing operation that targets open resolvers globally. An actor operating from the China Education and Research Network is conducting these probes, sending queries with encoded IP addresses to identify and measure responses from open DNS resolvers. The probes utilize selective wildcard responses, returning random IP addresses that inadvertently trigger amplification by Palo Alto's Cortex Xpanse product, polluting passive DNS data sources. This amplification hinders analysis of malicious activity and imposes resource burdens on networks worldwide.
Date
| Published | Created | Modified |
|---|---|---|
| June 6, 2024, 7:41 a.m. | June 6, 2024, 7:41 a.m. | June 6, 2024, 8:07 a.m. |
Indicators
https://research.openresolve.rs/
Attack Patterns
Secshow
T1584.002
T1584.003
T1583.002
T1584.004
T1584.001
T1583.001
T1583.004
T1583.003