Hello, welcome to the Tuesday, January 22nd, 2019 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

You know, I love it if our readers pay attention and watch their logs and send us interesting entries that they may find.

Latest example came from Vinny and Didi wrote it up earlier today.

And what's sort of interesting about this?

Well, actually a couple things are interesting here.

First of all, the get request uses an IP address in the host header and in the get request

itself that does not match the IP address of Venni's server.

Now this is often used to sort of test for open proxies.

What makes it a little bit odd is that the end of the URL is what looks like a random string.

Now, Vinny just manually forwarded this request to the IP address.

It apparently was intended to go to, and what he got back was yet another random string.

But this string actually has a little bit structure to it. There are 32. And what he got back was, well, yet another random string.

But this string actually has a little bit structure to it.

There are 32 hexade-simal characters and then a base 64 encoded part.

The base 64 encoded part does decode to an AS-256 encrypted string, at least based on the first six bytes of that string,

that indicate that it was encrypted using GPG, and yes, using a symmetric cipher AES-256.

So it could still be a sort of fancier proxy detection system. Often they just try to access Bing

or another large public site. Maybe they're trying to evade some honeypots here. But if you have

any insights, please let us know. And if you are operating a DNS server or if you're owning a domain February 1st is going to become an important day, also known as DNS Flag Day.

Now what's happening is that over the years, DNS has undergone some substantial changes.

And, well, as so often, not everybody sort of has kept up with these changes, which let the designers of DNS software to implement a number of workaround, which in turn has made DNS slower over the years. So

February 1st, many of these workarounds will be removed from popular DNS implementations and

...