1. Home
  2. Cisco Systems
  3. Bizarre URL in phishing email

Bizarre URL in phishing email

I received a phishing scam email recently. No news there, but one thing that caught me off guard was the URL given in the email: http://3289355434:82/webscr/index.php I am not sure I understand how the domain 3289355434 can resolve to an IP, but it does.

There is no TLD in that domain - could someone explain to me how that works?

Thanks

-tom

Reply to
tom
Loading thread data ...

This isn't anything to do with Cisco...

To answer your question:

3289355434 is an IP *address*. The valid IPv4 address formats include more than just the dotted-quad that you are accustomed to seeing. 3289355434 should be interpreted as a 32-bit integer whose bytes (most significant first) are the usual bytes you would see in the dotted quad.

For example, 3289355434 is hex 0xC40F94AA which is

0xC4 0x0F 0x94 0xAA which is 196 15 148 170 in decimal, which you would normally see as the dotted quad 196.15.148.170 .
Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.