Resolve 3289355434

Joseph S D Yao jsdy at center.osis.gov
Tue Mar 14 20:02:13 UTC 2006


On Mon, Mar 13, 2006 at 07:14:40PM -0800, tom wrote:
> I received a phishing scam email recently.  No news there, but one
> thing that caught me off guard was the URL given in the email:
> http://3289355434:82/webscr/index.php
> 
> I am not sure I understand how the domain 3289355434 can resolve to an
> IP, but it does.
> 
> There is no TLD in that domain - could someone explain to me how that
> works?
> 
> Thanks
> 
> -tom

An IP address is just a 64-bit number.  Usually it's split into four
eight-bit numbers, and expressed that way, with dots between them.  But
other formats work.

3289355434 = 170 + 256 * (148 + 256 * (15 + 256 * 196))
	= 196.15.148.170
	= 170.128.148.15.196.in-addr.arpa.
	= mail.lionshare.co.za.

http://www.pc-help.org/obscure.htm
http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/ip-address.html
http://www.iowight.com/iwindex/decimal.php3
http://www.kloth.net/services/iplocate.php
http://www.gregsearle.com/spam_tech.html

are among the first of page of what Google returned for "ip address
decimal".  The PHP ones contain converters!  [I just used 'dc'.]

-- 
Joe Yao
-----------------------------------------------------------------------
   This message is not an official statement of OSIS Center policies.



More information about the bind-users mailing list