4 ms·

DNS works both ways. It has pointer (PTR) records which allow you to assosciate an IP address you control with a domain name. Those are the opposite of an addre

by blfr 12y ago

DNS works both ways. It has pointer (PTR) records which allow you to assosciate an IP address you control with a domain name. Those are the opposite of an address record (A) with which you assosciate a domain name you control with an IP address. For Google.com, I can get an A record (IP address) $ dig +short google.com a 216.58.208.238 but I can also get a domain name for that IP $ dig -x 216.58.208.238 +short par10s22-in-f14.1e100.net. par10s22-in-f14.1e100.net. Google uses a service domain 1e100.net for their machines. Although maybe OP only means the hostname in the banner message. I grepped my mail logs for hostnames from Vietnam and couldn't find any IPs that would resolve back to localhost. EDIT: 'nanofortnight https://news.ycombinator.com/item?id=9068054 https://news.ycombinator.com/item?id=9068054 found a range of addresses that do. $ dig +short -x 123.26.2.1 localhost.

Tiksi 12y ago
To be a bit pedantic, you don't actually resolve the ip address itself. A reverse dns lookup actually just does a lookup of {the ip address with octets reversed}.in-addr.arpa: > host 216.58.208.238 238.208.58.216.in-addr.arpa domain name pointer par10s22-in-f14.1e100.net. You can actually look that up directly too: > dig +short ptr 238.208.58.216.in-addr.arpa par10s22-in-f14.1e100.net. When an isp gets a ip allocation, they specify the nameservers to use, and are responsible for that "subdomain" of the in-addr.arpa domain. If you trace the full resolve, it first goes to the root .in-addr.arpa servers, then arin.net nameserver, then finally you end up at: ;; AUTHORITY SECTION: 208.58.216.in-addr.arpa. 86400 IN NS ns3.google.com. which will return the actual ptr record.
expertonkappa 12y ago
Related http://arstechnica.com/civis/viewtopic.php?f=10&t=257855 http://arstechnica.com/civis/viewtopic.php?f=10&t=257855 222.252.56.* also resolves to localhost for example.
achillean 12y ago
The linked reports also include the search query that was performed to get the data, which in this case is: https://www.shodan.io/search?query=hostname%3Alocalhost https://www.shodan.io/search?query=hostname%3Alocalhost That gives you a list of IPs that you can check for yourself are affected by the issue.

by blfr 12y ago

Tiksi 12y ago

To be a bit pedantic, you don't actually resolve the ip address itself. A reverse dns lookup actually just does a lookup of {the ip address with octets reversed}.in-addr.arpa: > host 216.58.208.238 238.208.58.216.in-addr.arpa domain name pointer par10s22-in-f14.1e100.net. You can actually look that up directly too: > dig +short ptr 238.208.58.216.in-addr.arpa par10s22-in-f14.1e100.net. When an isp gets a ip allocation, they specify the nameservers to use, and are responsible for that "subdomain" of the in-addr.arpa domain. If you trace the full resolve, it first goes to the root .in-addr.arpa servers, then arin.net nameserver, then finally you end up at: ;; AUTHORITY SECTION: 208.58.216.in-addr.arpa. 86400 IN NS ns3.google.com. which will return the actual ptr record.

expertonkappa 12y ago

Related http://arstechnica.com/civis/viewtopic.php?f=10&t=257855 http://arstechnica.com/civis/viewtopic.php?f=10&t=257855 222.252.56.* also resolves to localhost for example.

achillean 12y ago

The linked reports also include the search query that was performed to get the data, which in this case is: https://www.shodan.io/search?query=hostname%3Alocalhost https://www.shodan.io/search?query=hostname%3Alocalhost That gives you a list of IPs that you can check for yourself are affected by the issue.