Curious Name Resolved!
Farid Hamjavar
hamjavar at unm.edu
Mon Aug 23 18:03:55 UTC 1999
On Mon, 23 Aug 1999, James Scott Hunter wrote:
> Date: Mon, 23 Aug 1999 17:37:48 GMT
> From: James Scott Hunter <scott at colossus.sky.net>
> To: comp-protocols-dns-bind at moderators.isc.org
> Newsgroups: comp.protocols.dns.bind
> Subject: Curious Name Resolved!
>
> A friend asked an unusual question today about some spam he received this
> weekend. I won't include the full URL of the spam, just the interesting part -
> as I would want to inadvertantly help these people out.
>
> The URL he received started with:
>
> http://3345775946/
>
> He asked me how an URL like this would work, and demonstrated it for me.
> Checking it out with nslookup it resolves to user.exit.de.
>
> What magic is at work here??
>
% qdc 3345775946
#Input is all digits: "3345775946"
#Answer in dotted form: 199.108.125.74
% qdc 199.108.125.74
#Input is in dotted notation: "199.108.125.74"
#OctetIndex[1] is 199 and 199 x 16777216 = 3338665984
#OctetIndex[2] is 108 and 108 x 65536 = 7077888
#OctetIndex[3] is 125 and 125 x 256 = 32000
#OctetIndex[4] is 74 and 74 x 1 = 74
#
#Answer is in decimal 3345775946
#Answer is in hex is c76c7d4a
ps: qdc is my perl script
Farid
UNM
More information about the bind-users
mailing list