Re: [mod-security-users] strange DNS query

[Robert P. <rpa...@fe...>]

Looks like this has been around for quite a while:

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing-modsecurity-status-reporting/

Sincerely,
Robert Paprocki
c. 949.345.5709


On Fri, Nov 1, 2024 at 1:36 PM Hans Mayer via mod-security-users <
mod...@li...> wrote:

>
> Dear All,
>
> I am using Apache/2.4.62 on Debian with the modsecurity-crs package
> which is Producer ModSecurity for Apache/2.9.7 and Rule Set
> OWASP_CRS/4.9.0-dev
>
> Each time I restart Apache I find a strange log entry in BINDs query log.
> The system is looking for a name
>
> GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org
> as A resource record which does not exists.
> The query is almost the same except the number ( 1730491019 ) wich is
> the Unix time.
> Also this string GIXDSLRRGQWGGMY is different on different servers.
>
> Any idea for what this should be useful ? Does it make sense ?
> Which part is actually doing this ?
>
> Kind regards
> Hans
>
> --
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>