I got a spam today (from a yahoo server, surprise!) with nothing but a single link. http:// 2927755261/ I separated the http so it would not be a link in your email... suggest not going to it without proper measures. it takes you to a record search site. When I look up this number block here, http://www.ip-adress.com/ip_tracer/2927755261 it comes up with a different ip address... The ip address has no correlation to the numbers I searched for though. How is it possible to have a url that does not conform to the internet standards? Even ip addresses need 'periods' between each group of numbers.... and everything seems to require a period somewhere or the browser will get angry. At first I thought it was some kind of browser hack, but then the iptrace pulls up an ip. so how is this possible?
On 6/20/2012 11:21 PM, Bob Hoffman wrote:> I got a spam today (from a yahoo server, surprise!) with nothing but a > single link. > > http:// 2927755261/ > I separated the http so it would not be a link in your email... suggest > not going to it without proper measures. > it takes you to a record search site. > > When I look up this number block here, > http://www.ip-adress.com/ip_tracer/2927755261 > it comes up with a different ip address... > The ip address has no correlation to the numbers I searched for though. > > > How is it possible to have a url that does not conform to the internet > standards? > Even ip addresses need 'periods' between each group of numbers.... > and everything seems to require a period somewhere or the browser will > get angry. > > At first I thought it was some kind of browser hack, but then the > iptrace pulls up an ip. > > so how is this possible? > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos > >okay, I got it...the browsers all the use of IP decimals.. Not sure why they would do that, but I guess it is needed.. Great, another way to hide spammers.. http://www.allredroster.com/iptodec.htm
On Wednesday 20 June 2012, Bob Hoffman <bob at bobhoffman.com> wrote:> I got a spam today (from a yahoo server, surprise!) with nothing but > a single link. > > http:// 2927755261/2927755261 in hexadecimal is AE81FFFD. If you change this to AE.81.FF.FD and convert it back to decimal, you get 174.129.255.253, which is apparently the IP address that http://www.ip- adress.com/ip_tracer/2927755261 gave you. I don't know why Web browsers accept this format, and I haven't seen this trick in several years. -- Yves Bellefeuille <yan at storm.ca> "La Esperanta Civito ne rifuzas anticipe la kunlaboron de erarintoj, se ili konscias pri sia eraro." -- Heroldo Komunikas, n-ro 473.
On Wed, Jun 20, 2012 at 11:21:41PM -0400, Bob Hoffman wrote:> I got a spam today (from a yahoo server, surprise!) with nothing but a > single link. > > http:// 2927755261/ > I separated the http so it would not be a link in your email... suggest > not going to it without proper measures. > it takes you to a record search site. > > When I look up this number block here, > http://www.ip-adress.com/ip_tracer/2927755261 > it comes up with a different ip address... > The ip address has no correlation to the numbers I searched for though.Oh, yes it does. 174.129.255.253 is the same IPA. It's the same number in the same way that 0x0f and 15 are the same number.> How is it possible to have a url that does not conform to the internet > standards?It does conform.> Even ip addresses need 'periods' between each group of numbers....No, they don't. That's the trick. There are no groups of numbers in an IPA, they exist only in our minds. 2927755261 here is just a decimal number. The "dotted quad" is a way to specify each byte of a 32 bit IPA, akin to using hex numbers. This is the decimal number it corresponds to. (and it's the way software stores IPAs internally, just another integer.) There are byte-order issues, see man htonl(3) and man ntohl(3). Dave