Domain name with one large number (not IP address)

Hi,

I have just received an email message which was a phishing attempt to
collect PayPal information, and I have notified PayPal.

However, the interesting thing is that the link was going to:

http://999412483/icons/small/paypal/...reInfo/paypal/

It didn't know it was possible to have a domain name without extension
(.com etc) or it is just some IP address, but presented in a different
format?

Thanks,
Sebastien

Seb blathered :-
> Hi,
>
> I have just received an email message which was a phishing attempt to
> collect PayPal information, and I have notified PayPal.
>
> However, the interesting thing is that the link was going to:
>
> http://999412483/icons/small/paypal/...reInfo/paypal/
>
> It didn't know it was possible to have a domain name without extension
> (.com etc) or it is just some IP address, but presented in a different
> format?
>
> Thanks,
> Sebastien
>
IIRC, it's the IP address as one large 32-bit number (rather than 4
8-bit numbers). Could be wrong, though.

http://www.dnsstuff.com/ has a form that can convert between the two
formats.

xF,

....Nick

On 28 Aug 2006 02:00:17 -0700, "Seb" <(E-Mail Removed)> wrote:

|Hi,
|
|I have just received an email message which was a phishing attempt to
|collect PayPal information, and I have notified PayPal.
|
|However, the interesting thing is that the link was going to:
|
|http://999412483/icons/small/paypal/...reInfo/paypal/
|
|It didn't know it was possible to have a domain name without extension
|(.com etc) or it is just some IP address, but presented in a different
|format?

Despite the new V4 Junk system I still have a filter which *deletes*
anything apparently from any bank or financial institution.
--
Dave Fawthrop <dave hyphenologist co uk> Google Groups is IME the *worst*
method of accessing usenet. GG subscribers would be well advised get a
newsreader, say Agent, and a newsserver, say news.individual.net. These
will allow them: to see only *new* posts, a killfile, and other goodies.

> I have just received an email message which was a phishing attempt to
> collect PayPal information, and I have notified PayPal.

I found buying a domain and "personalising" the email address you give
to any third party i.e. amazon@ paypal@ also helps narrow things down -
you know if you get an email to (E-Mail Removed) its
automatically a scam.

"Nicholas Thomas" <ku.gro.snagap-(E-Mail Removed)> wrote in
message news:44f2b5aa$0$634$(E-Mail Removed)...
> Seb blathered :-
>> Hi,
>>
>> I have just received an email message which was a phishing attempt to
>> collect PayPal information, and I have notified PayPal.
>>
>> However, the interesting thing is that the link was going to:
>>
>> http://999412483/icons/small/paypal/...reInfo/paypal/
>>
>> It didn't know it was possible to have a domain name without extension
>> (.com etc) or it is just some IP address, but presented in a different
>> format?
>>
>> Thanks,
>> Sebastien
>>
> IIRC, it's the IP address as one large 32-bit number (rather than 4
> 8-bit numbers). Could be wrong, though.

Its the IP address in decimal.
Except that address (59.145.211.3) is reserved so it shouldn't be usable.

On Mon, 28 Aug 2006, "dennis@home" <(E-Mail Removed)>
wrote:-

<snip>

>Its the IP address in decimal.
>Except that address (59.145.211.3) is reserved so it shouldn't be usable.

You need to update your list of unassigned space. The entire of
59.0.0.0/8 is allocated to APNIC and, checking their whois database
shows it's allocated to:

Request: 59.145.211.3
connected to whois.arin.net [199.43.0.144:43] ...
connected to whois.apnic.net [202.12.29.13:43] ...
% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 59.145.211.0 - 59.145.211.15
netname: DCMTechnologies1554-ggn
descr: DCM Technologies
descr: 125,
descr: Udyog Vihar Phase-I
descr: Gurgoan
descr: Haryana
descr: India
descr: Contact Person:VK Bhatia
descr: Email:(E-Mail Removed)
descr: Phone:911245122820
country: IN
admin-c: NA40-AP
tech-c: NA40-AP
mnt-by: MAINT-IN-BBIL
status: ASSIGNED NON-PORTABLE
changed: (E-Mail Removed) 20041222
source: APNIC


Regards,
David Bolt

--
Member of Team Acorn checking nodes at 50 Mnodes/s: http://www.distributed.net/
AMD1800 1Gb WinXP/SUSE 9.3 | AMD2400 256Mb SuSE 9.0 | A3010 4Mb RISCOS 3.11
AMD2400(32) 768Mb SUSE 10.0 | Falcon 14Mb TOS 4.02 | A4000 4Mb RISCOS 3.11
AMD2600(64) 512Mb SUSE 10.0 | | RPC600 129Mb RISCOS 3.6

"Colin Wilson" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) t...
>> I have just received an email message which was a phishing attempt to
>> collect PayPal information, and I have notified PayPal.
>
> I found buying a domain and "personalising" the email address you give
> to any third party i.e. amazon@ paypal@ also helps narrow things down -
> you know if you get an email to (E-Mail Removed) its
> automatically a scam.

I did this to start with, but then got hit with someone sending mail to a
load of random stuff@mydomain I changed it so as long as a particular word
was in the mail address before the @, the mail would get though to me, for
example...

Say the word was sparks

sparks@... would work

sparks-amazon@... would work
amazon-sparks@... world work
amazon@... would be rejected

This seems to work really well!

> I did this to start with, but then got hit with someone sending mail to a
> load of random stuff@mydomain I changed it so as long as a particular word
> was in the mail address before the @, the mail would get though to me, for
> example...

I haven't had any problems as yet (been doing it for at least 2 years
now) - although I do have a lot of heavy duty filtering on Mailwasher
for regular mail.