george on 21 Oct 2017 18:24:32 -0700

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Obfuscated domain names

brent timothy saner replied that the xe's and xf's in the "domain name"
below are hex:


Alas, there is still a matter of interpretation; I attempted my
interpretation three different ways:




Aha ! The third one of these is accepted by nslookup:,
but _that_ IP address is for the well-known server going by the name
"barefruit error handling." I kinda think it's a catchall for badly
converted "hidden" domains. I've run across them before when I mis-type
an IPV4 address. Note that the actual alphanumeric domain name is not
revealed by nslookup. Whois outright rejects the hex data.

Trying again with another one of the obfuscated domain names:

by my interpretation becomes,
which flunks the nslookup test ...

But a hexadecimal conversion to text gives стройка.kz, a plain-Jane
Russian-language website that whois interprets as,
A.K.A., with the primary IP address.....:,
whose server covers IPV4's to with AS200532.
Happily, стройка.kz and both go to the same webpage.

I had no luck with the other two domains in my original email.

George Langford
Philadelphia Linux Users Group         --
Announcements -
General Discussion  --