Statistics

This shows IP addresses making repeated requests for the same FQDN over and over again (i.e. many times per minute).

There are two reasons to want to do this:

• To cause a Denial of Service against the IP address shown in the Reverse DNS column (because the FROM address in a DNS query is easily spoofed)
• To attempt to overload the DNS server by making repeated requests

In both cases WinBIND protects against this by automatically adding a DENY rule to the Windows Firewall within a few minutes of detection. WinBIND removes the offending client from the firewall rule after a certain period of time, so the Occurrences column shows the number of times this IP address found itself on the blacklist again.