As I'm running four different AS112 sinkholes in Poland, here's couple of numbers you may find interesting.

The most popular private network in Poland seems to be (at least among those not or badly configured) 192.168/16. Reverse requests for this space account for 68% of AS112 sinkholed traffic. The next one, but barely, is 172.16/12 (17%) and last - 10/8 (15%).

Out of domains I can share are of interest, top is Google's thread (230 queries per second on average across four AS112 instances), and the proxy autodiscovery wpad.home.arpa (182 queries per second).

As always, I'll be reaching out to the "top talkers" to let them know they're leaking queries to internet. For those of you that reacted and fixed your systems - kudos!

Please make sure to configure properly your DNS resolvers people, and don't leak reverse queries to internet! To check for more info - please visit https://lukasz.bromirski.net/as-112-project/. #as112 #anycast #plnog #dns #atman #epix #vectra