Forward request energystar.gov?

Dev Community Apps & Creations
1

Is this just something odd about my network, or are other people seeing this in their logs?

19:31:24 DNSServer: ***forward request
19:31:29 DNSServer: DNS request received!
19:31:29 DNSServer: Source: ('162.213.39.42', 48493)
19:31:29 DNSServer: Domain: energystar.gov
2

Is this just something odd about my network, or are other people seeing this in their logs?

19:31:24 DNSServer: ***forward request
19:31:29 DNSServer: DNS request received!
19:31:29 DNSServer: Source: ('162.213.39.42', 48493)
19:31:29 DNSServer: Domain: energystar.gov

That IP address does NOT resolve to 'energystar.gov'.

It resolves as follows:





[chuck@Lizum ~.8]$ nslookup 162.213.39.42
Server: 192.168.1.12
Address: 192.168.1.12#53

Non-authoritative answer:

42.39.213.162.in-addr.arpa name = weber.freenode.net.


Authoritative answers can be found from:


[chuck@Lizum ~.9]$ nslookup energystar.gov

Server: 192.168.1.12

Address: 192.168.1.12#53


Non-authoritative answer:

Name: energystar.gov

Address: 128.121.47.113


[chuck@Lizum ~.10]$






Additional data located here:   http://www.robtex.net/en/advisory/ip/162/213/39/42/


 


 


Or am I missing something??

            




            


          

          

            

              



              
                  
                  
              3
              
            

            

              
Hmm, doesn't always seem to be doing it. Probably just something seriously odd on my end. Sorry!

            




            


          

          

            

              



              
                  
                  
              4
              
            

            

              




Hmm, doesn't always seem to be doing it. Probably just something seriously odd on my end. Sorry!






I would make absolutely certain you aren't being DNS-spoofed.

            




            


          

          

            

              



              
                  
                  
              5
              
            

            

              
Are you sure your Plexconnect box is not in the DMZ or that you have port 53 forwarded from the Internet?  



It looks like someone on IP 162.213.39.42 has made a request via your Plexconnect DNS server.

            




            


          

          

            

              



              
                  
                  
              6
              
            

            

              
I'll check those things. The machine does not have a public IP address, pretty sure I'm not forwarding any ports from the internet either.


It did only seem to happen when I launched PlexConnect. However, I've checked the log and don't see the entries any more.


most weird!