I am running my own DNS and I am logging all the DNS lookups. Today, I realized that there are over 200 entries for unwanted subdomain queries in the log.
Interestingly, these non-existent subdomains are possibly sensitive areas. Another issue is that these entries DO NOT exist in either access.log or error.log.
I am kinda worried that these are hack attempts.
I have 3 questions:
- How can I add these non-existent subdomain queries to error.log?
- Is there any Ubuntu package out there that can block this kind of hack attempt?
- What are my other options?
Sample DNS query log:
15-Dec-2011 01:12:41.726 queries: info: client 18.104.22.168#42014: query: adminarea.site.com IN A -ED (22.214.171.124)