@jedisct1 @pingpingya @GetUmbrella can you see anything under good.gd.?
@ioc32 @pingpingya I couldn't find any A record for these DGAs, only CNAMEs to good[.]gd and e[.]zc0[.]net
-
-
@jedisct1@pingpingya judging from *DSC* stats, the flood was A/NOERROR. Can botnets "reboot"? Could that explain a 16-fold increase in qps? -
@ioc32@pingpingya Which IP did these queries resolve to? Where are the clients located? - 4 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.