[PLUG] Domain Naming Question: Why does the name 3546435852 resolve?

[Aaron Ten Clay]

On Tue April 4 2006 09:39, David Mandel wrote:
> 
>     Someone sent me a phishing note that didn't get killed by my spam
> filter, so I got distracted and looked at it.  Surprisingly, it trys
> to trick one into going to:
> 
>          http://3546435852/SomeLongPathName which fishes paypal
> 
> I didn't think "3546435852" was a valid name.
> However, my DNS seems to resolve it to 211.98.81.12 which is an
> address in China (Big Surprise).
> 

That's a decimal encoded IP address. The same as typing http://211.98.81.12/SomeLongPathName into your browser. There's no DNS resolution happening at all.

A quick wikipedia search doesn't reveal a terribly useful page describing the concept, but basically take the 32 bit binary address and convert that to decimal to get a decimal encoding. Traditionally we take 8 bits at a time and convert them to decimal, separated by dots. Just two different ways to represent the same thing.

-Aaron
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 191 bytes
Desc: not available
URL: <http://lists.pdxlinux.org/pipermail/plug/attachments/20060404/f4425ba4/attachment.asc>