Possible attack? Funny DNS requests

[bAgZ]

Hi there i am wondering if anyone can help me out. I have a Linux server hosting about 70 domains. Lately i have been noticing in my logs /var/log/messages following requests

Feb 10 02:43:42 gipsy named[572]: lame server resolving '83.52.225.82.ipwhois.rfc-ignorant.org' (in 'ipwhois.rfc-ignorant.org'?): 127.0.0.1#53
Feb 10 02:43:55 gipsy named[572]: lame server resolving '53.16.22.216.ipwhois.rfc-ignorant.org' (in 'ipwhois.rfc-ignorant.org'?): 127.0.0.1#53

Sometimes its up to three a second. Searched on google for similar behavior and found nothing. Has anyone seen this before? Could it be that my server is blacklisted? Or could it be some kind of hack?

[Egaladeist]

Try here...

http://www.google.ca/search?hl=en&cl...G=Search&meta=
Google Search: .ipwhois.rfc-ignorant.org' (in 'ipwhois.rfc-ignorant.org'?): 127.0.0.1#53

[zencoder]

Try this -> http://www.rfc-ignorant.org/

[bAgZ]

Fair enough but how do i stop it? I did visit thei website before and it still does not explain why is this happening? Any ides?

[frpeter]

Hellp,

check the bind administration manual on lame servers. The can be disabled.

Or you can use the following as an example:

logging {
category "lame-servers" { "null"; };
channel null {
null;
severity warning;
};
};

The part that you want is the category line.