1. tcpreplay.net/knot

/1.1.1.1

1.1. 環境

tcpreplay.net.          172800  IN      NS      ns1.tcpreplay.net.
tcpreplay.net.          172800  IN      NS      ns2.tcpreplay.net.
tcpreplay.net.          172800  IN      NS      ns3.tcpreplay.net.
tcpreplay.net.          172800  IN      NS      ns4.tcpreplay.net.

;; ADDITIONAL SECTION:
ns1.tcpreplay.net.      172800  IN      A       52.213.198.181
ns2.tcpreplay.net.      172800  IN      A       52.213.198.181
ns3.tcpreplay.net.      172800  IN      A       52.213.198.181
ns4.tcpreplay.net.      172800  IN      A       52.213.198.181

117yen.com.             3600    IN      NS      ns1.117yen.com.
117yen.com.             3600    IN      NS      ns3.117yen.com.
117yen.com.             3600    IN      NS      ns4.117yen.com.
117yen.com.             3600    IN      NS      ns2.117yen.com.
out.117yen.com.         30      IN      NS      ns.out.117yen.com.

ns.out.117yen.com.      30      IN      A       34.255.69.36

1.2. 毒入り返答

$ dig -t txt cf1111.tcpreplay.net @52.213.198.181

; <<>> DiG 9.16.1-Ubuntu <<>> -t txt cf1111.tcpreplay.net @52.213.198.181
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31506
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 56d2e7e3ce872e5744a2976a5f4061667e2e0961ddf90e84 (good)
;; QUESTION SECTION:
;cf1111.tcpreplay.net.          IN      TXT

;; AUTHORITY SECTION:
cf1111.tcpreplay.net.   300     IN      NS      ns-out.out.117yen.com.

;; ADDITIONAL SECTION:
ns-out.out.117yen.com.  170     IN      A       63.35.157.66

;; Query time: 251 msec
;; SERVER: 52.213.198.181#53(52.213.198.181)
;; WHEN: 土  8月 22 09:05:58 JST 2020
;; MSG SIZE  rcvd: 128

1.3. 真のA

ns-out.out.117yen.com.  30      IN      A       54.77.128.254

1.4. 毒盛

$ dig -t txt cf1111.tcpreplay.net @63.35.157.66

; <<>> DiG 9.16.1-Ubuntu <<>> -t txt cf1111.tcpreplay.net @63.35.157.66
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7873
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: df0988bb4545bc50a19936e35f4061a2ad7496fbf8d0cf0a (good)
;; QUESTION SECTION:
;cf1111.tcpreplay.net.          IN      TXT

;; ANSWER SECTION:
cf1111.tcpreplay.net.   30      IN      TXT     "!!! FAKE DANGER !!!"

;; AUTHORITY SECTION:
cf1111.tcpreplay.net.   30      IN      NS      ns.cf1111.tcpreplay.net.

;; ADDITIONAL SECTION:
ns.cf1111.tcpreplay.net. 30     IN      A       63.35.157.66

;; Query time: 255 msec
;; SERVER: 63.35.157.66#53(63.35.157.66)
;; WHEN: 土  8月 22 09:06:58 JST 2020
;; MSG SIZE  rcvd: 142

1.5. 1.1.1.1

$ dig -t txt cf1111.tcpreplay.net @1.1.1.1

; <<>> DiG 9.16.1-Ubuntu <<>> -t txt cf1111.tcpreplay.net @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37260
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;cf1111.tcpreplay.net.          IN      TXT

;; ANSWER SECTION:
cf1111.tcpreplay.net.   30      IN      TXT     "!!! FAKE DANGER !!!"

;; Query time: 903 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: 土  8月 22 09:10:47 JST 2020
;; MSG SIZE  rcvd: 101

tmaeno@nve20:~$ dig -t ns cf1111.tcpreplay.net @1.1.1.1

; <<>> DiG 9.16.1-Ubuntu <<>> -t ns cf1111.tcpreplay.net @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37394
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;cf1111.tcpreplay.net.          IN      NS

;; ANSWER SECTION:
cf1111.tcpreplay.net.   30      IN      NS      ns.cf1111.tcpreplay.net.

;; Query time: 239 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: 土  8月 22 09:10:56 JST 2020
;; MSG SIZE  rcvd: 86

ns.cf1111.tcpreplay.net. 30     IN      A       63.35.157.66