We have an "exists" DNS logger attached to our SPF records, in order
to assess the efficiency of SPF. So far, most of the log entries came
from our own hosts rejecting spammers trying to spoof our own
domains. "Real" hits (due to forgeries submitted to 3rd party servers)
used to be quite rare (only once every couple of days).
However, today this changed! As of 14h40, we've already had 7 hits!
Mar 16 02:14:27.872 client 212.159.13.49#44996: query:
200(_dot_)104(_dot_)206(_dot_)182(_dot_)vortex\(_at_)ltnb(_dot_)lu(_dot_)ltnb(_dot_)lu(_dot_)spflog(_dot_)lll(_dot_)lu
IN A
Mar 16 07:22:35.390 client 63.145.240.6#32468: query:
143(_dot_)248(_dot_)21(_dot_)94(_dot_)arpadffy\(_at_)linux(_dot_)lu(_dot_)linux(_dot_)lu(_dot_)spflog(_dot_)lll(_dot_)lu
IN A
Mar 16 10:20:30.193 client 193.97.201.199#51650: query:
24(_dot_)237(_dot_)154(_dot_)112(_dot_)xivwgacyhbo\(_at_)prophecy(_dot_)lu(_dot_)linux(_dot_)lu(_dot_)spflog(_dot_)lll(_dot_)lu
IN A
Mar 16 12:24:04.710 client 213.165.64.17#32827: query:
200(_dot_)44(_dot_)201(_dot_)13(_dot_)jar\(_at_)ltnb(_dot_)lu(_dot_)ltnb(_dot_)lu(_dot_)spflog(_dot_)lll(_dot_)lu
IN A
Mar 16 12:28:40.891 client 212.159.13.49#44996: query:
203(_dot_)217(_dot_)204(_dot_)79(_dot_)small\(_at_)linux(_dot_)lu(_dot_)linux(_dot_)lu(_dot_)spflog(_dot_)lll(_dot_)lu
IN A
Mar 16 13:54:37.268 client 213.165.64.17#32827: query:
68(_dot_)94(_dot_)36(_dot_)117(_dot_)IssacUCormier\(_at_)prophecy(_dot_)lu(_dot_)linux(_dot_)lu(_dot_)spflog(_dot_)lll(_dot_)lu
IN A
Mar 16 13:56:56.661 client 213.165.64.17#32831: query:
213(_dot_)166(_dot_)54(_dot_)194(_dot_)tjager\(_at_)ltnb(_dot_)lu(_dot_)ltnb(_dot_)lu(_dot_)spflog(_dot_)lll(_dot_)lu
IN A
Anybody else observing this level of activity? Is it due to a wider
adoption of SPF (good), or is there currently a new virus on the run
(not so good)?
Regards,
Alain