Is there currently a DDoS attack on my server DNS?

Virtualmin
1
SYSTEM INFORMATION
OS type and version Debian 12
Webmin version 2.201
Virtualmin version 7.20.2
Webserver version Apache version 2.4.61

Hi

Since December 2023, I have been using Debian 12 with Virtualmin/Webmin instead of Cpanel/WHM. Currently, my server has been lagging for the past hour, and I saw this in the system logs:

Aug 03 16:13:25 ns.SERVER.com named[679]: client @0x7f85134c4168 18.207.255.89#62872 (TheSItEnNeR.OrG): query (cache) 'TheSItEnNeR.OrG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:25 ns.SERVER.com named[679]: client @0x7f84fce2a168 18.207.255.89#38401 (TheSItEnner.ORG): query (cache) 'TheSItEnner.ORG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:25 ns.SERVER.com named[679]: client @0x7f85119b8168 18.207.255.89#17860 (TheSItEnNer.org): query (cache) 'TheSItEnNer.org/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:25 ns.SERVER.com named[679]: client @0x7f85119b8168 18.207.255.89#61457 (TheSItENNEr.orG): query (cache) 'TheSItENNEr.orG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:25 ns.SERVER.com named[679]: client @0x7f84fdd8b168 18.207.255.89#20920 (TheSItEnNEr.oRg): query (cache) 'TheSItEnNEr.oRg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:25 ns.SERVER.com named[679]: client @0x7f84fce2a168 18.207.255.89#61168 (TheSItEnNEr.ORg): query (cache) 'TheSItEnNEr.ORg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:25 ns.SERVER.com named[679]: client @0x7f85162f3168 18.207.255.89#55791 (TheSItEnnER.orG): query (cache) 'TheSItEnnER.orG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:25 ns.SERVER.com named[679]: client @0x7f85134c4168 18.207.255.89#64882 (TheSItEnnEr.OrG): query (cache) 'TheSItEnnEr.OrG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:26 ns.SERVER.com named[679]: client @0x7f84fdd8b168 18.207.255.89#25195 (TheSItEnNeR.OrG): query (cache) 'TheSItEnNeR.OrG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:26 ns.SERVER.com named[679]: client @0x7f850f8e0168 18.234.177.203#48832 (TheSItENneR.ORG): query (cache) 'TheSItENneR.ORG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:26 ns.SERVER.com named[679]: client @0x7f85119b8168 18.234.177.203#8945 (TheSItEnneR.ORG): query (cache) 'TheSItEnneR.ORG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:26 ns.SERVER.com named[679]: client @0x7f85011b3168 18.234.177.203#40433 (TheSItENneR.ORg): query (cache) 'TheSItENneR.ORg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:26 ns.SERVER.com named[679]: client @0x7f8517346168 18.234.177.203#45584 (TheSItENneR.ORG): query (cache) 'TheSItENneR.ORG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:26 ns.SERVER.com named[679]: client @0x7f85119b8168 18.234.177.203#20482 (TheSItEnnER.ORG): query (cache) 'TheSItEnnER.ORG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:26 ns.SERVER.com named[679]: client @0x7f8511578168 18.234.177.203#62687 (TheSItENnEr.Org): query (cache) 'TheSItENnEr.Org/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:26 ns.SERVER.com named[679]: client @0x7f8517346168 18.234.177.203#24886 (TheSItENneR.ORg): query (cache) 'TheSItENneR.ORg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:27 ns.SERVER.com named[679]: client @0x7f850f8e0168 18.234.177.203#10106 (TheSItENNER.ORG): query (cache) 'TheSItENNER.ORG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:27 ns.SERVER.com named[679]: client @0x7f85134c4168 50.17.79.243#36955 (TheSItEnner.ORg): query (cache) 'TheSItEnner.ORg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:27 ns.SERVER.com named[679]: client @0x7f85134c4168 50.17.79.243#62380 (TheSItEnNer.orG): query (cache) 'TheSItEnNer.orG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:27 ns.SERVER.com named[679]: client @0x7f850f8e0168 50.17.79.243#40452 (TheSItENNer.Org): query (cache) 'TheSItENNer.Org/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:27 ns.SERVER.com named[679]: client @0x7f85162f3168 50.17.79.243#30485 (TheSItENnER.org): query (cache) 'TheSItENnER.org/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:27 ns.SERVER.com named[679]: client @0x7f84fce2a168 50.17.79.243#31415 (TheSItENNer.oRg): query (cache) 'TheSItENNer.oRg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:27 ns.SERVER.com named[679]: client @0x7f8517346168 50.17.79.243#20468 (TheSItEnneR.OrG): query (cache) 'TheSItEnneR.OrG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:27 ns.SERVER.com named[679]: client @0x7f850ee20168 50.17.79.243#47879 (TheSItEnNeR.oRG): query (cache) 'TheSItEnNeR.oRG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:28 ns.SERVER.com named[679]: client @0x7f850f8e0168 50.17.79.243#19557 (TheSItENNer.org): query (cache) 'TheSItENNer.org/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:29 ns.SERVER.com named[679]: client @0x7f85154cd168 18.207.255.89#31523 (TheSItENnER.Org): query (cache) 'TheSItENnER.Org/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:29 ns.SERVER.com named[679]: client @0x7f85154cd168 18.207.255.89#35253 (TheSItEnNeR.ORG): query (cache) 'TheSItEnNeR.ORG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:29 ns.SERVER.com named[679]: client @0x7f84fdd8b168 18.207.255.89#20310 (TheSItENNer.oRG): query (cache) 'TheSItENNer.oRG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:29 ns.SERVER.com named[679]: client @0x7f850f8e0168 18.207.255.89#11199 (TheSItENNER.OrG): query (cache) 'TheSItENNER.OrG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:29 ns.SERVER.com named[679]: client @0x7f84fd0cd168 18.207.255.89#29273 (TheSItENNer.orG): query (cache) 'TheSItENNer.orG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f8511578168 18.207.255.89#10991 (TheSItENNeR.oRg): query (cache) 'TheSItENNeR.oRg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f84fdd8b168 18.234.177.203#30436 (TheSItEnNeR.Org): query (cache) 'TheSItEnNeR.Org/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f8511578168 18.234.177.203#36647 (TheSItEnNEr.ORG): query (cache) 'TheSItEnNEr.ORG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f85134c4168 18.234.177.203#19583 (TheSItEnNeR.OrG): query (cache) 'TheSItEnNeR.OrG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f850ee20168 18.234.177.203#43996 (TheSItEnneR.org): query (cache) 'TheSItEnneR.org/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f85134c4168 18.234.177.203#26298 (TheSItEnner.oRG): query (cache) 'TheSItEnner.oRG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f850ee20168 18.234.177.203#62448 (TheSItEnNer.orG): query (cache) 'TheSItEnNer.orG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f85162f3168 50.17.79.243#27861 (TheSItENNEr.ORg): query (cache) 'TheSItENNEr.ORg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f85119b8168 50.17.79.243#47567 (TheSItEnNeR.orG): query (cache) 'TheSItEnNeR.orG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f850ee20168 50.17.79.243#45160 (TheSItEnNer.ORg): query (cache) 'TheSItEnNer.ORg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f84fce2a168 50.17.79.243#61682 (TheSItEnNER.orG): query (cache) 'TheSItEnNER.orG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:30 ns.SERVER.com named[679]: client @0x7f84fce2a168 50.17.79.243#45150 (TheSItENNeR.oRG): query (cache) 'TheSItENNeR.oRG/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f850f8e0168 50.17.79.243#37090 (TheSItEnNER.oRg): query (cache) 'TheSItEnNER.oRg/A/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f85134c4168 18.207.255.89#26783 (TheSItEnner.oRg): query (cache) 'TheSItEnner.oRg/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f84fce2a168 18.207.255.89#44188 (TheSItENnEr.ORG): query (cache) 'TheSItENnEr.ORG/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f850ee20168 18.207.255.89#60896 (TheSItEnNER.oRg): query (cache) 'TheSItEnNER.oRg/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f85119b8168 18.207.255.89#28001 (TheSItEnner.oRg): query (cache) 'TheSItEnner.oRg/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f84fd0cd168 18.207.255.89#7690 (TheSItEnNer.ORg): query (cache) 'TheSItEnNer.ORg/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f850ee20168 18.234.177.203#59843 (TheSItENNER.org): query (cache) 'TheSItENNER.org/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f84fd0cd168 18.234.177.203#59352 (TheSItEnneR.orG): query (cache) 'TheSItEnneR.orG/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:31 ns.SERVER.com named[679]: client @0x7f85154cd168 18.234.177.203#32460 (TheSItENNEr.orG): query (cache) 'TheSItENNEr.orG/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:32 ns.SERVER.com named[679]: client @0x7f850ee20168 18.234.177.203#25252 (TheSItEnNEr.oRg): query (cache) 'TheSItEnNEr.oRg/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:32 ns.SERVER.com named[679]: client @0x7f84fdd8b168 18.234.177.203#54664 (TheSItENNeR.OrG): query (cache) 'TheSItENNeR.OrG/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:32 ns.SERVER.com named[679]: client @0x7f85154cd168 50.17.79.243#41080 (TheSItEnNEr.oRg): query (cache) 'TheSItEnNEr.oRg/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:32 ns.SERVER.com named[679]: client @0x7f8511578168 50.17.79.243#6755 (TheSItEnNEr.oRG): query (cache) 'TheSItEnNEr.oRG/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:32 ns.SERVER.com named[679]: client @0x7f84fce2a168 50.17.79.243#29098 (TheSItENNEr.org): query (cache) 'TheSItENNEr.org/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:32 ns.SERVER.com named[679]: client @0x7f85154cd168 50.17.79.243#13035 (TheSItENnER.org): query (cache) 'TheSItENnER.org/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:32 ns.SERVER.com named[679]: client @0x7f8511578168 50.17.79.243#20888 (TheSItENnER.org): query (cache) 'TheSItENnER.org/AAAA/IN' denied (allow-query-cache did not match)
Aug 03 16:13:34 ns.SERVER.com named[679]: client @0x7f850ee20168 18.207.255.89#49139 (TheSItEnnER.oRg): query (cache) 'TheSItEnnER.oRg/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:34 ns.SERVER.com named[679]: client @0x7f85162f3168 18.207.255.89#36064 (TheSItENNeR.ORG): query (cache) 'TheSItENNeR.ORG/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:34 ns.SERVER.com named[679]: client @0x7f84fd0cd168 18.207.255.89#20642 (TheSItEnNER.Org): query (cache) 'TheSItEnNER.Org/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:34 ns.SERVER.com named[679]: client @0x7f84fdd8b168 18.207.255.89#23878 (TheSItEnNER.OrG): query (cache) 'TheSItEnNER.OrG/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:34 ns.SERVER.com named[679]: client @0x7f85011b3168 18.207.255.89#56489 (TheSItEnner.oRg): query (cache) 'TheSItEnner.oRg/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:34 ns.SERVER.com named[679]: client @0x7f84fdd8b168 18.234.177.203#23140 (TheSItENNER.OrG): query (cache) 'TheSItENNER.OrG/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:34 ns.SERVER.com named[679]: client @0x7f85162f3168 18.234.177.203#32613 (TheSItEnner.oRg): query (cache) 'TheSItEnner.oRg/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:34 ns.SERVER.com named[679]: client @0x7f85162f3168 18.234.177.203#13107 (TheSItEnnER.ORg): query (cache) 'TheSItEnnER.ORg/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:35 ns.SERVER.com named[679]: client @0x7f84fcbe0168 18.234.177.203#51507 (TheSItENNEr.Org): query (cache) 'TheSItENNEr.Org/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:35 ns.SERVER.com named[679]: client @0x7f84fdd8b168 18.234.177.203#37728 (TheSItENnEr.org): query (cache) 'TheSItENnEr.org/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:35 ns.SERVER.com named[679]: client @0x7f85134c4168 50.17.79.243#20543 (TheSItEnner.oRg): query (cache) 'TheSItEnner.oRg/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:35 ns.SERVER.com named[679]: client @0x7f85154cd168 50.17.79.243#29263 (TheSItENNEr.OrG): query (cache) 'TheSItENNEr.OrG/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:35 ns.SERVER.com named[679]: client @0x7f8511578168 50.17.79.243#6667 (TheSItENneR.oRG): query (cache) 'TheSItENneR.oRG/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:35 ns.SERVER.com named[679]: client @0x7f85011b3168 50.17.79.243#13379 (TheSItENnER.oRg): query (cache) 'TheSItENnER.oRg/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:35 ns.SERVER.com named[679]: client @0x7f8511578168 50.17.79.243#18243 (TheSItEnner.oRG): query (cache) 'TheSItEnner.oRG/MX/IN' denied (allow-query-cache did not match)
Aug 03 16:13:37 ns.SERVER.com named[679]: client @0x7f85011b3168 18.207.255.89#39819 (TheSItEnneR.ORg): query (cache) 'TheSItEnneR.ORg/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:37 ns.SERVER.com named[679]: client @0x7f85134c4168 18.207.255.89#10343 (TheSItEnNER.ORg): query (cache) 'TheSItEnNER.ORg/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:37 ns.SERVER.com named[679]: client @0x7f85119b8168 18.207.255.89#60278 (TheSItENNEr.Org): query (cache) 'TheSItENNEr.Org/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:37 ns.SERVER.com named[679]: client @0x7f850ee20168 18.207.255.89#7898 (TheSItENNER.Org): query (cache) 'TheSItENNER.Org/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:37 ns.SERVER.com named[679]: client @0x7f850ee20168 18.207.255.89#44444 (TheSItENnER.oRg): query (cache) 'TheSItENnER.oRg/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:37 ns.SERVER.com named[679]: client @0x7f85154cd168 18.234.177.203#38557 (TheSItENneR.oRg): query (cache) 'TheSItENneR.oRg/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:37 ns.SERVER.com named[679]: client @0x7f85011b3168 18.234.177.203#25379 (TheSItEnNer.org): query (cache) 'TheSItEnNer.org/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:37 ns.SERVER.com named[679]: client @0x7f85162f3168 18.234.177.203#27546 (TheSItEnnEr.oRg): query (cache) 'TheSItEnnEr.oRg/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:38 ns.SERVER.com named[679]: client @0x7f85162f3168 18.234.177.203#24633 (TheSItENner.ORG): query (cache) 'TheSItENner.ORG/NS/IN' denied (allow-query-cache did not match)
Aug 03 16:13:38 ns.SERVER.com named[679]: client @0x7f850ee20168 18.234.177.203#60263 (TheSItEnNEr.Org): query (cache) 'TheSItEnNEr.Org/NS/IN' denied (allow-query-cache did not match)

Do you know how to block this by doing the simplest thing?

Thanks
Sincerely

2

I don’t think this is a ddos attack. Check here it’s the same OS and same output

3

I’m on my phone so can’t give specifics you can Google the process. You can put a permanent rule in your firewall for the 4 or 5 IP ranges involved.

4

I might have been mistaken; perhaps it was the hosting provider OVH that experienced a problem for about 2 hours between 3:00 PM and 5:00 PM. It happened suddenly and then resolved just as suddenly. The server’s CPU usage was normal between 3:00 PM and 5:00 PM, as was the memory usage. I’ll see if it happens again