<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>big security problem if you have an uncontrolled and not authorized web server on that ip and that is not firewalled</p>
<p><br>
</p>
<p>to find it out check arp tables on switches to follow switch port where it isphisical linked</p>
<br>
<img tabindex="0" crossorigin="anonymous" id="img615236" style="max-width: 99.9%; -moz-user-select: none;" contenttype="image/png" size="0" src="cid:bdc2d58d-9e89-4c5a-8ac8-8232cd9e10a8"><br>
<br>
<br>
<br>
<br>
<br>
<a id="LPlnk554975" href="https://www.linkedin.com/in/alberto-colosi" class="OWAAutoLink">https://www.linkedin.com/in/alberto-colosi</a><br>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Bhangui, Sandeep - BLS CTR <Bhangui.Sandeep@bls.gov><br>
<b>Sent:</b> Saturday, September 17, 2016 7:52 PM<br>
<b>To:</b> Alberto ----; bind-users@lists.isc.org<br>
<b>Subject:</b> RE: Organization IP address is getting redirected to a website which does not belong to the organization.</font>
<div> </div>
</div>
<div>
<div style="">
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Understood and I am sure they are aware of those protocols.</span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">We do not have a webserver which is hosted on 146.142.7.113 that I can categorically say as that falls under our team.</span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Network folks are having a tough time even finding an active device with that IP on the network.</span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Thanks</span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Sandeep</span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> bind-users [mailto:bind-users-bounces@lists.isc.org]
<b>On Behalf Of </b>Alberto ----<br>
<b>Sent:</b> Saturday, September 17, 2016 12:52 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: Organization IP address is getting redirected to a website which does not belong to the organization.</span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
</p>
<div id="divtagdefaultwrapper">
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black">hmmmmmmmmmmm if they manage firewalls , they should be aware of TCP/IP foundamentals and HTTP working and much more</span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black">the browser perform a GET on
</span><span style="font-size:10.0pt; font-family:"Calibri",sans-serif; color:black">146.142.7.113</span><span style="font-family:"Calibri",sans-serif; color:black"> with RFC HTTP protocol then
</span><span style="font-size:10.0pt; font-family:"Calibri",sans-serif; color:black">146.142.7.113</span><span style="font-family:"Calibri",sans-serif; color:black"> say item moved / redirect to <a style="color: blue; text-decoration: underline;" href="http://us.watcheezy.com/" id="LPlnk483644">http://us.watcheezy.com/</a></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black">you have to check web server configuration or HTML / PHP / ........ pages on root link from the web server
</span><span style="font-size:10.0pt; font-family:"Calibri",sans-serif; color:black">146.142.7.113</span><span style="font-family:"Calibri",sans-serif; color:black"></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black">when the browser get a REDIRECT , is the browser on client machine that perform a new GET statement on the new address
</span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black">is normal that firewall team see nothing else if not a packet capture and analisys is performed</span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p style="background: white none repeat scroll 0% 0%; margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<div>
<div>
<div style="text-align: center; background: white none repeat scroll 0% 0%; margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;" align="center">
<span style="font-family:"Calibri",sans-serif; color:black">
<hr align="center" size="2" width="98%">
</span></div>
<div id="x_divRplyFwdMsg">
<p style="background: white none repeat scroll 0% 0%; margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black"> bind-users <<a style="color: blue; text-decoration: underline;" href="mailto:bind-users-bounces@lists.isc.org">bind-users-bounces@lists.isc.org</a>>
on behalf of Bhangui, Sandeep - BLS CTR <<a style="color: blue; text-decoration: underline;" href="mailto:Bhangui.Sandeep@bls.gov">Bhangui.Sandeep@bls.gov</a>><br>
<b>Sent:</b> Saturday, September 17, 2016 6:43 PM<br>
<b>To:</b> Lyle; <a style="color: blue; text-decoration: underline;" href="mailto:bind-users@lists.isc.org">
bind-users@lists.isc.org</a><br>
<b>Subject:</b> RE: Organization IP address is getting redirected to a website which does not belong to the organization.</span><span style="font-family:"Calibri",sans-serif; color:black">
</span></p>
<div>
<p style="background: white none repeat scroll 0% 0%; margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
</div>
</div>
</div>
<div>
<p style="background: white none repeat scroll 0% 0%; margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman",serif;">
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif; color:black">Thanks<br>
<br>
We suspected that but network folks are not able to find any device with that IP on the BLS network.<br>
<br>
Also it seems firewall folks claim they looked for the traffic coming in the BLS network and if the redirect is happening from a host which is 146.142.7.113 they should have seen some traffic correct and apparently we do not see any traffic.<br>
<br>
Thanks<br>
Sandeep<br>
<br>
<br>
-----Original Message-----<br>
From: bind-users [<a style="color: blue; text-decoration: underline;" href="mailto:bind-users-bounces@lists.isc.org">mailto:bind-users-bounces@lists.isc.org</a>] On Behalf Of Lyle<br>
Sent: Saturday, September 17, 2016 12:01 PM<br>
To: <a style="color: blue; text-decoration: underline;" href="mailto:bind-users@lists.isc.org">
bind-users@lists.isc.org</a><br>
Subject: Re: Organization IP address is getting redirected to a website which does not belong to the organization.<br>
<br>
On 09/17/16 10:51, Bhangui, Sandeep - BLS CTR wrote:<br>
> Hi<br>
><br>
> Not exactly sure whether this is a DNS issue but hoping someone here on this forum can provide some advice/suggestion as I am trying to figure out what is going on.<br>
><br>
> Our organization BLS owns ( registered with the registrar ) the network address 146.142.xxx.xxx.<br>
><br>
> But if someone from the Internet [ outside of BLS network ) tries to go to "<a style="color: blue; text-decoration: underline;" href="http://146.142.7.113">http://146.142.7.113</a>" it gets redirected to a site in UK called "us.watcheezy.com"<br>
><br>
> I have checked the DNS from the BLS side and we do not have any entry of any kind for the record 146.142.7.113 on our DNS.<br>
><br>
> I have also done DNS lookups for watcheezy.com and those seem to be good too with respect to IP and the NS and as to what those NS are reporting.<br>
><br>
> Can anyone throw some light on as to what is going on here.....does not look like a DNS issue to me but I could be wrong.<br>
><br>
> Thanks<br>
> Sandeep<br>
><br>
> _______________________________________________<br>
> Please visit <a style="color: blue; text-decoration: underline;" href="https://lists.isc.org/mailman/listinfo/bind-users">
https://lists.isc.org/mailman/listinfo/bind-users</a> to <br>
> unsubscribe from this list<br>
><br>
> bind-users mailing list<br>
> <a style="color: blue; text-decoration: underline;" href="mailto:bind-users@lists.isc.org">
bind-users@lists.isc.org</a><br>
> <a style="color: blue; text-decoration: underline;" href="https://lists.isc.org/mailman/listinfo/bind-users">
https://lists.isc.org/mailman/listinfo/bind-users</a><br>
There is a host listening on 146.142.7.113 tcp port 80. It's issuing a<br>
302 redirect to <a style="color: blue; text-decoration: underline;" href="http://www.watcheezy.com">
http://www.watcheezy.com</a> at ip address 37.187.76.95. <br>
That host is issuing a 301 redirect to <a style="color: blue; text-decoration: underline;" href="http://us.watcheezy.com">
http://us.watcheezy.com</a> at 37.187.76.95.<br>
<br>
Lyle Giese<br>
LCR Computer Services, Inc.<br>
<br>
_______________________________________________<br>
Please visit <a style="color: blue; text-decoration: underline;" href="https://lists.isc.org/mailman/listinfo/bind-users">
https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a style="color: blue; text-decoration: underline;" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a style="color: blue; text-decoration: underline;" href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
<br>
_______________________________________________<br>
Please visit <a style="color: blue; text-decoration: underline;" href="https://lists.isc.org/mailman/listinfo/bind-users">
https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a style="color: blue; text-decoration: underline;" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a style="color: blue; text-decoration: underline;" href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>