Compromised BIND?

Jan-Piet Mens jpmens.dns at gmail.com
Tue May 31 19:38:01 UTC 2011


> I have a BIND 9.8.0-P2 server instance running on a production server. My
> firewall is showing repeated attempts by named.exe to connect to IP
> addresses in foreign countries on ports 6666, 6667 and 6669 - common IRC
> ports used by worms/trojans/zombies.

Sounds like you're running an IRC bot...


        -JP



More information about the bind-users mailing list