http://3505021947 - how does this resolve?

Ryan Waldron rew at traveller.com
Tue Jun 8 18:00:41 UTC 1999


On Tue, 8 Jun 1999, Dan Winchester wrote:

> I'm seeing more and more addresses in the format above.
> 
> How do they resolve? What organisation allocates them? Are they in any
> way derived from the IP address?

I have mostly seen them in spam messages, but they appear to be the
decimal version of the hex version of the IP address, with dots
removed.

For instance, 3505021947 is D0EA63FB in hex.  Insert dots, and you
have:

D0.EA.63.FB

Convert back to decimal, and you have

208.234.99.251

which is www.freestation.com (though they don't appear to have reverse
lookups working right).  I think they seem to count on browsers (for
example) treating it as a regular 4-byte integer, which then fits
nicely into the standard address structure, so lookups will succeed,
but the IP address won't appear right at all.

I have no idea why they do this, unless it's just being stupid, and
they spammers are getting lucky in that the intersection of their
program's screwup and a browser anomaly means that they get lots of
visitors for their trouble anyway.

Who knows, though - this may be a perfectly acceptable way to express
an IP address, buried somewhere down in RFC938828 that I've never
heard of.  There's lots of things like that I haven't heard of. :)

--
Ryan Waldron    |||   http://www.hsv.tis.net/~rew    |||    rew at traveller.com
                         http://www.erebor.com

"You read me Shakespeare on the Rolling Thames, 
 That Old River Poet that never, ever ends.
 Our Thumping hearts hold the Ravens in,
 And keep the tower from tumbling." -KB



More information about the bind-users mailing list