Dmitry Golubovsky on 21 Oct 2017 19:09:34 -0700

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Obfuscated domain names

This is a construction materials sales website in Russian, but registered in Kazakhstan. Nothing dangerous ;)

On Sat, Oct 21, 2017 at 9:34 PM, brent saner <> wrote:
at a hacker con, we're on it...

the .kz domain translates to "a thing that has been constructed". moment, please

sent from my toaster.

On Oct 21, 2017 21:24, <> wrote:

brent timothy saner replied that the xe's and xf's in the "domain name"
below are hex:


Alas, there is still a matter of interpretation; I attempted my
interpretation three different ways:




Aha ! The third one of these is accepted by nslookup:,
but _that_ IP address is for the well-known server going by the name
"barefruit error handling." I kinda think it's a catchall for badly
converted "hidden" domains. I've run across them before when I mis-type
an IPV4 address. Note that the actual alphanumeric domain name is not
revealed by nslookup. Whois outright rejects the hex data.

Trying again with another one of the obfuscated domain names:

by my interpretation becomes,
which flunks the nslookup test ...

But a hexadecimal conversion to text gives стройка.kz, a plain-Jane
Russian-language website that whois interprets as,
A.K.A., with the primary IP address.....:,
whose server covers IPV4's to with AS200532.
Happily, стройка.kz and both go to the same webpage.

I had no luck with the other two domains in my original email.

George Langford

Philadelphia Linux Users Group         --
Announcements -
General Discussion  --

Dmitry Golubovsky
Anywhere on the Web
Philadelphia Linux Users Group         --
Announcements -
General Discussion  --