Dmitry Golubovsky on 21 Oct 2017 19:52:49 -0700

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Obfuscated domain names

It appears to be this website: (тайга-транзит.su - also construction materials sales).

There is a decoder here: (in Russian) which tells that this is CP1252 -> UTF-8

On Sat, Oct 21, 2017 at 10:38 PM, brent saner <> wrote:
so that one you couldn't find out:


I have NO idea what kind of encoding or weird translation that is, but that's hex => utf-8.

On Oct 21, 2017 21:34, "brent saner" <> wrote:
at a hacker con, we're on it...

the .kz domain translates to "a thing that has been constructed". moment, please

sent from my toaster.

On Oct 21, 2017 21:24, <> wrote:

brent timothy saner replied that the xe's and xf's in the "domain name"
below are hex:


Alas, there is still a matter of interpretation; I attempted my
interpretation three different ways:




Aha ! The third one of these is accepted by nslookup:,
but _that_ IP address is for the well-known server going by the name
"barefruit error handling." I kinda think it's a catchall for badly
converted "hidden" domains. I've run across them before when I mis-type
an IPV4 address. Note that the actual alphanumeric domain name is not
revealed by nslookup. Whois outright rejects the hex data.

Trying again with another one of the obfuscated domain names:

by my interpretation becomes,
which flunks the nslookup test ...

But a hexadecimal conversion to text gives стройка.kz, a plain-Jane
Russian-language website that whois interprets as,
A.K.A., with the primary IP address.....:,
whose server covers IPV4's to with AS200532.
Happily, стройка.kz and both go to the same webpage.

I had no luck with the other two domains in my original email.

George Langford

Philadelphia Linux Users Group         --
Announcements -
General Discussion  --

Dmitry Golubovsky
Anywhere on the Web
Philadelphia Linux Users Group         --
Announcements -
General Discussion  --