Bizarre URL in phishing email

Mar 14, 2006 1 Replies

I received a phishing scam email recently. No news there, but one thing that caught me off guard was the URL given in the email: http://3289355434:82/webscr/index.php I am not sure I understand how the domain 3289355434 can resolve to an IP, but it does.



There is no TLD in that domain - could someone explain to me how that works?



Thanks


-tom



This isn't anything to do with Cisco...

To answer your question:

3289355434 is an IP *address*. The valid IPv4 address formats include more than just the dotted-quad that you are accustomed to seeing. 3289355434 should be interpreted as a 32-bit integer whose bytes (most significant first) are the usual bytes you would see in the dotted quad.

For example, 3289355434 is hex 0xC40F94AA which is

0xC4 0x0F 0x94 0xAA which is 196 15 148 170 in decimal, which you would normally see as the dotted quad 196.15.148.170 .

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required