,
3 tweets,
2 min read
Read on Twitter
@jpanzer Yes it only appears on the 23rd. It was accessed from one of the two alfa banks servers that had all the other accesses (96.15) 18 times, and 12 times from a previously unseen alfa bank address (97.137). This does look like hand checks after reporting.
@jpanzer But as I look more closely this is interesting. The lookups as logged are grouped in clusters of four (or three at the end there) all occurring at the same time. Why would hand lookups be grouped like that? 
@jpanzer I suppose if it was trying multiple DNS servers at the same time but they were really multiple addresses for the same DNS server, you might see that. Still seems odd.
Also those lookups have gaps of a couple minutes, which really suggests caching wasn't happening.
Also those lookups have gaps of a couple minutes, which really suggests caching wasn't happening.
