[nsp-sec] Possible MX query reflection attack to 212.241.192.20

[John Kristoff]

Hi Team,

We're seeing an unreasonably higher than normal rate of MX queries for
l2refused largely from 212.241.192.20.  Looks like it might be some sort
of spoofed reflector attack against 212.241.192.20.  We are mostly
seeing the traffic out of Europe, not a lot, but enough to be noticeable.
I sent a note off to felix at Host Europe, but perhaps some folks like
the PIPEX or guys could take a look and see?  Thanks as always,

John