Resolve 3289355434

[Jeff Lightner]

What!?  Next you'll be telling me the bank account info I sent to the
Nigerian that wants to pay me a fee for allowing him to park $7 Million
in my account was for a scam too.

-----Original Message-----
From: bind-users-bounce at isc.org [mailto:bind-users-bounce at isc.org] On
Behalf Of John Hascall
Sent: Tuesday, March 14, 2006 3:11 PM
To: tom; comp-protocols-dns-bind at isc.org
Cc: abuse at mail.lionshare.co.za; postmaster at mail.lionshare.co.za
Subject: Re: Resolve 3289355434 


> I received a phishing scam email recently.  No news there, but one
> thing that caught me off guard was the URL given in the email:
> http://3289355434:82/webscr/index.php
> I am not sure I understand how the domain 3289355434 can resolve to an
> IP, but it does.
> There is no TLD in that domain - could someone explain to me how that
> works?

It doesn't resolve to an IP because it is an IP address, albeit
in a form you don't see very often (except in this kind of scam).

> traceroute 3289355434
traceroute to 3289355434 (196.15.148.170), 30 hops max, 40 byte packets
 1  router-129-186-144-0.iastate.edu (129.186.145.254)  1 ms  0 ms  1 ms
         ...
15  lipco-brokers-gw.telkom-ipnet.co.za (196.25.251.202)  330 ms  331 ms
329 ms
16  mail.lionshare.co.za (196.15.148.170)  332 ms  331 ms  332 ms

I rather doubt that paypal operates a server at
some legal services company in South Africa.
In my opinion, they've probably been "owned".

John