4 ms·
"Sends a request to a malicious URL". Malicious is relative of course. The code reads: url = "http://101.32.99.28/name?<package_name>" requests.get(ur
by dthul 6y ago
"Sends a request to a malicious URL". Malicious is relative of course.
The code reads:
url = "http://101.32.99.28/name?<package_name>"
requests.get(url, timeout=30)
So it looks like the author wants to track the number of installs. Nothing is done with the response value (at least for the setup.py that I saw).
Edit: seems to be a Tokyo based IP.
- sodality2 6y agoThe IP is from "Tencent Building, Kejizhongyi Avenue". That's weird, if it was just because they were an ISP, why would it say "Tencent Building"? https://ipapi.co/101.32.99.28/ https://ipapi.co/101.32.99.28/
- capableweb 6y agoUltimately up to the owner of the ASN what to use as the organization name. In this case, the ASN chose the name "Tencent Building, Kejizhongyi Avenue", you can see it over at https://bgp.he.net/AS132203 https://bgp.he.net/AS132203 (The ASN is the owner of this specific IP under their specific ranges that they own)
- dthul 6y agoThat surprised me too (the IP lookup I used said "domain: tencent.com") but I don't understand enough about IP to tell whether that's unusual or not. Unrelated tidbit: tencent.com returns an empty reply for me at the moment.
- capableweb 6y ago> tencent.com returns an empty reply for me at the moment That's because the correct address is https://www.tencent.com/ https://www.tencent.com/ (prefixed with www.)
- dthul 6y agoOh, nice catch! Strange setup.
- sodality2 6y agoWow. Can the massive chinese conglomerate really not forward that to www?
- basilgohar 6y agoThey are hardly the only site to do that. It is only by convention that non-www-prefixed websites tend to redirect to www-prefixed one. It's not at all mandatory and technically they are two different hostnames. It may be intentional to ensure only exactly the right hostnames are ever used, e.g., www, ftp, smtp, etc.
- deelowe 6y agoSeems to be working as intended, it's a non www url.
- sodality2 6y agoI rarely see a site that doesn't redirect it to the appropriate subdomain. Then again I don't often check it unless it's broken
- oefrha 6y agoRather unusual, but it’s a corporate rather than customer-facing website so not really all that important. It’s not like apple.com, google.com, or microsoft.com where the brand name domain is the product or is where the products are sold. I just checked and apex domains for all their flagship products redirect to www just fine.
- robjan 6y agoLooks like the first line of the address for the headquarters of Tencent Cloud in Shenzhen.
- genmon 6y agoAssuming requester IPs are being logged, this is a good way to build a map of potentially vulnerable organisations. No need to do anything now.