full-disclosure - strange domain name in phishing email

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <21ae1b060603131736i5c3b33f3p@mail.gmail.com>
Date: Tue Mar 14 01:36:46 2006
From: abryson at bytefocus.com (Alice Bryson)
Subject: strange domain name in phishing email

Yes, this is only a way of expressing an IP address.
Try the following C code, you would find out the answer.

#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

int main()
{
    printf("%lu\n", htonl(inet_addr("83.211.166.179")));
    return 0;
}

it prints out 1406379699.


2006/3/11, Brian Dessent <brian@...sent.net>:
> Jianqiang Xin wrote:
>
> > I received several phishing emails. One interesting thing is the link
> > to phishing website has the link:
> > http://1406379699/dbweb/ws/ebay/index.htm
>
> This is a very old technique.  Most people think that dotted-quad
> decimal is the only way to express an IP address but they can in fact be
> written in a variety of formats - octal, hexadecimal, and/or combined as
> a single 32 bit word.  Read <http://www.pc-help.org/obscure.htm> for
> more.
>
> Brian
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>


--
Homepage:http://www.lwang.org
We collect spam for research at:
mailto:abryson@...efocus.com