[Full-disclosure] what is DNS response that 255.255.255.255?
pabloroberto at gmail.com
Tue Mar 17 17:26:16 GMT 2009
ping windowsupdate.daemon.sh it is resolving to a public IP.
PING windowsupdate.daemon.sh (220.127.116.11) 56(84) bytes of data.
inetnum: 18.104.22.168 - 22.214.171.124
descr: CHINANET Guangdong province network
descr: Data Communication Division
descr: China Telecom
At this web site are showing something different but the virus is using
the same DNS Resolution.
Do you see anything else?
Could you tell me more about your tests?
El mar, 17-03-2009 a las 17:52 +0900, 김무성 escribió:
> I’m testing malware.
> It DNS query xxxxxxxxxxx.ods.org and xxxxxxxxx.daemon.sh
> And response is 255.255.255.255
> What is 255.255.255.255?
> Can DNS hosting company set that specific DNS name set to
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
Full-Disclosure is hosted and sponsored by Secunia.