<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>hmmmmmmmmmmm if they manage firewalls , they should be aware of TCP/IP foundamentals and HTTP working and much more</p>
<p><br>
</p>
<p>the browser perform a GET on <font size="2"><span style="font-size:10pt;">146.142.7.113</span></font> with RFC HTTP protocol then
<font size="2"><span style="font-size:10pt;">146.142.7.113</span></font> say item moved / redirect to <a id="LPlnk483644" href="http://us.watcheezy.com/" class="OWAAutoLink">http://us.watcheezy.com/</a></p>
<p><br>
</p>
<p>you have to check web server configuration or HTML / PHP / ........ pages on root link from the web server
<font size="2"><span style="font-size:10pt;">146.142.7.113</span></font></p>
<p><br>
</p>
<p>when the browser get a REDIRECT , is the browser on client machine that perform a new GET statement on the new address
<br>
</p>
<p><br>
</p>
<p>is normal that firewall team see nothing else if not a packet capture and analisys is performed</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<br>
<div style="color: rgb(0, 0, 0);">
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> on behalf of Bhangui, Sandeep - BLS CTR <Bhangui.Sandeep@bls.gov><br>
<b>Sent:</b> Saturday, September 17, 2016 6:43 PM<br>
<b>To:</b> Lyle; bind-users@lists.isc.org<br>
<b>Subject:</b> RE: Organization IP address is getting redirected to a website which does not belong to the organization.</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Thanks<br>
<br>
We suspected that but network folks are not able to find any device with that IP on the BLS network.<br>
<br>
Also it seems firewall folks claim they looked for the traffic coming in the BLS network and if the redirect is happening from a host which is 146.142.7.113 they should have seen some traffic correct and apparently we do not see any traffic.<br>
<br>
Thanks<br>
Sandeep<br>
<br>
<br>
-----Original Message-----<br>
From: bind-users [<a href="mailto:bind-users-bounces@lists.isc.org">mailto:bind-users-bounces@lists.isc.org</a>] On Behalf Of Lyle<br>
Sent: Saturday, September 17, 2016 12:01 PM<br>
To: bind-users@lists.isc.org<br>
Subject: Re: Organization IP address is getting redirected to a website which does not belong to the organization.<br>
<br>
On 09/17/16 10:51, Bhangui, Sandeep - BLS CTR wrote:<br>
> Hi<br>
><br>
> Not exactly sure whether this is a DNS issue but hoping someone here on this forum can provide some advice/suggestion as I am trying to figure out what is going on.<br>
><br>
> Our organization BLS owns ( registered with the registrar ) the network address 146.142.xxx.xxx.<br>
><br>
> But if someone from the Internet [ outside of BLS network ) tries to go to "<a href="http://146.142.7.113">http://146.142.7.113</a>" it gets redirected to a site in UK called "us.watcheezy.com"<br>
><br>
> I have checked the DNS from the BLS side and we do not have any entry of any kind for the record 146.142.7.113 on our DNS.<br>
><br>
> I have also done DNS lookups for watcheezy.com and those seem to be good too with respect to IP and the NS and as to what those NS are reporting.<br>
><br>
> Can anyone throw some light on as to what is going on here.....does not look like a DNS issue to me but I could be wrong.<br>
><br>
> Thanks<br>
> Sandeep<br>
><br>
> _______________________________________________<br>
> Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to
<br>
> unsubscribe from this list<br>
><br>
> bind-users mailing list<br>
> bind-users@lists.isc.org<br>
> <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
There is a host listening on 146.142.7.113 tcp port 80. It's issuing a<br>
302 redirect to <a href="http://www.watcheezy.com">http://www.watcheezy.com</a> at ip address 37.187.76.95.
<br>
That host is issuing a 301 redirect to <a href="http://us.watcheezy.com">http://us.watcheezy.com</a> at 37.187.76.95.<br>
<br>
Lyle Giese<br>
LCR Computer Services, Inc.<br>
<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div>
</span></font></div>
</div>
</body>
</html>