<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Latha;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Understood and I am sure they are aware of those protocols.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">We do not have a webserver which is hosted on 146.142.7.113 that I can categorically say as that falls under our team.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Network folks are having a tough time even finding an active device with that IP on the network.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Sandeep<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> bind-users [mailto:bind-users-bounces@lists.isc.org]
<b>On Behalf Of </b>Alberto ----<br>
<b>Sent:</b> Saturday, September 17, 2016 12:52 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: Organization IP address is getting redirected to a website which does not belong to the organization.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="divtagdefaultwrapper">
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">hmmmmmmmmmmm if they manage firewalls , they should be aware of TCP/IP foundamentals and HTTP working and much more<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">the browser perform a GET on
</span><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:black">146.142.7.113</span><span style="font-family:"Calibri",sans-serif;color:black"> with RFC HTTP protocol then
</span><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:black">146.142.7.113</span><span style="font-family:"Calibri",sans-serif;color:black"> say item moved / redirect to <a href="http://us.watcheezy.com/" id="LPlnk483644">http://us.watcheezy.com/</a><o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">you have to check web server configuration or HTML / PHP / ........ pages on root link from the web server
</span><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:black">146.142.7.113</span><span style="font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">when the browser get a REDIRECT , is the browser on client machine that perform a new GET statement on the new address
<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">is normal that firewall team see nothing else if not a packet capture and analisys is performed<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<div>
<div class="MsoNormal" align="center" style="text-align:center;background:white">
<span style="font-family:"Calibri",sans-serif;color:black">
<hr size="2" width="98%" align="center">
</span></div>
<div id="x_divRplyFwdMsg">
<p class="MsoNormal" style="background:white"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"> bind-users <<a href="mailto:bind-users-bounces@lists.isc.org">bind-users-bounces@lists.isc.org</a>>
on behalf of Bhangui, Sandeep - BLS CTR <<a href="mailto:Bhangui.Sandeep@bls.gov">Bhangui.Sandeep@bls.gov</a>><br>
<b>Sent:</b> Saturday, September 17, 2016 6:43 PM<br>
<b>To:</b> Lyle; <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<b>Subject:</b> RE: Organization IP address is getting redirected to a website which does not belong to the organization.</span><span style="font-family:"Calibri",sans-serif;color:black">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:black">Thanks<br>
<br>
We suspected that but network folks are not able to find any device with that IP on the BLS network.<br>
<br>
Also it seems firewall folks claim they looked for the traffic coming in the BLS network and if the redirect is happening from a host which is 146.142.7.113 they should have seen some traffic correct and apparently we do not see any traffic.<br>
<br>
Thanks<br>
Sandeep<br>
<br>
<br>
-----Original Message-----<br>
From: bind-users [<a href="mailto:bind-users-bounces@lists.isc.org">mailto:bind-users-bounces@lists.isc.org</a>] On Behalf Of Lyle<br>
Sent: Saturday, September 17, 2016 12:01 PM<br>
To: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
Subject: Re: Organization IP address is getting redirected to a website which does not belong to the organization.<br>
<br>
On 09/17/16 10:51, Bhangui, Sandeep - BLS CTR wrote:<br>
> Hi<br>
><br>
> Not exactly sure whether this is a DNS issue but hoping someone here on this forum can provide some advice/suggestion as I am trying to figure out what is going on.<br>
><br>
> Our organization BLS owns ( registered with the registrar ) the network address 146.142.xxx.xxx.<br>
><br>
> But if someone from the Internet [ outside of BLS network ) tries to go to "<a href="http://146.142.7.113">http://146.142.7.113</a>" it gets redirected to a site in UK called "us.watcheezy.com"<br>
><br>
> I have checked the DNS from the BLS side and we do not have any entry of any kind for the record 146.142.7.113 on our DNS.<br>
><br>
> I have also done DNS lookups for watcheezy.com and those seem to be good too with respect to IP and the NS and as to what those NS are reporting.<br>
><br>
> Can anyone throw some light on as to what is going on here.....does not look like a DNS issue to me but I could be wrong.<br>
><br>
> Thanks<br>
> Sandeep<br>
><br>
> _______________________________________________<br>
> Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to
<br>
> unsubscribe from this list<br>
><br>
> bind-users mailing list<br>
> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
> <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
There is a host listening on 146.142.7.113 tcp port 80. It's issuing a<br>
302 redirect to <a href="http://www.watcheezy.com">http://www.watcheezy.com</a> at ip address 37.187.76.95.
<br>
That host is issuing a 301 redirect to <a href="http://us.watcheezy.com">http://us.watcheezy.com</a> at 37.187.76.95.<br>
<br>
Lyle Giese<br>
LCR Computer Services, Inc.<br>
<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>