[nsp-sec] dnsrooted.com

[Scott A. McIntyre]

Hi,

For the last week and a bit I've seen numerous DNS probes queries in my DNS honeypots from 88.12.3.170 and a few other IPs looking for "1.2.3.4.dnsrooted.com" (or dnsrooted.us.to) where 1.2.3.4 is the IP address that they're prodding.  

Is this yet another "security researcher" or someone else?  Some days the majority of the traffic my DNS honeypots see are from Cymru, Shadowserver and other researchers.  ;-)

Admin Name: Carlos Diaz
Admin Organization: TTL expired
Admin Street: Madrid
Admin City: Madrid
Admin State/Province: Madrid
Admin Postal Code: 28005
Admin Country: Spain
Admin Phone: +34.644266224
Admin Fax:
Admin Email: ttlexpired at hotmail.com


Thanks,

Scott A. McIntyre
AS1221 Telstra