Horse move?

g00d2011-05-20 10:38:03

Domain Name System

g00d, 2011-05-20 10:38:03

Horse move?

I don't know what to call this topic :)

I was on some site switching between tabs and then returning to the old tab
I saw the contents of my local web server.
And then I went a little crazy, because the content is mine, but the address in the browser is dp.000.in.

try to enter this address in your browser's address bar, provided that you have your own web server and it is up on the same local machine, you will see it.

further from what I saw, I began to study the moment a little bit…
it turned out that such a record really exists in the DNS and it refers to the loopback, and I have a question, why? why? and isn't that an atalaka?

then I found only a couple of links with this info (maybe I didn’t search well)
serverfault.com/questions/191988/strange-redirect-to-localhost-http-dp-000-in
forum.uniformserver.com/index.php?showtopic=1867

_ some questions are still relevant ...

Has anyone met with such a similar one?

Answer the question

In order to leave comments, you need to log in

10 answer(s)

MealstroM, 2011-05-20
@MealstroM

problem sucked from the finger.
WELL AND WHAT that it is so made?
ping habrahabr.mealstrom.org.ua… so what?
you can think that this is a competent ddos stub, or someone
didn’t change the default configs correctly.

Seigmen, 2011-05-20
@Seigmen

Didn't understand anything, what is it? I saw many times when, during ddos attacks, resource owners changed the entry to 127.0.0.1

Mark, 2011-05-20
@printf

There are many such names, for example eblan.us
It seems to me that this is just a way to park a domain. It is convenient if the site is still under development - each developer can access their local version of the site using the real domain name, there are fewer trivial errors during transfer, etc.

Nicholas, 2011-05-20
@pnick

You don't even have to go far. Try ping on habralab.ru:)

Sergey Beresnev, 2011-05-20
@sectus

> nslookup dp.000.in

antivir, 2011-05-20
@antivir

This address is not available to me. The 000.in zone also seems to be gone.
I see two options:
1. This procedure is somehow done by a JS script
2. An entry has been added to hosts.

Puma Thailand, 2011-05-20
@opium

What prevents to register any address on any domain, including 127.0.0.1?

vinxru, 2011-05-20
@vinxru

It's not JS.
Someone (http://www.ipaddress.com/domain_whois/000.in) came up with the idea to register the address 127.0.0.1 in the DNS :) Well done! I checked from computers installed in different parts of the world. Now dp.000.in=127.0.0.1 in all root DNS servers, as well as Google.
nslookup dp.000.in dns1.name-services.com
nslookup dp.000.in 8.8.8.8

Andrey Bilyk, 2011-05-20
@YAAP

So yes
PING dp.000.in (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.027 ms
I don't see any attack, except that after these events everyone rushes to use dp.000.in instead of localhost.
Just a funny joke =)

Vlad Zhivotnev, 2011-05-20
@inkvizitor68sl

Yes, nothing special, I created a lo entry in the search-domain a long time ago, so as not to write a lot.