Re: OT a DNS/phishing puzzle

[Brian Reichert <reichert@xxxxxxxxxxx>]

On Thu, Feb 24, 2005 at 08:22:19PM -0800, walt wrote:
> The part that worries me is when I do an nslookup on the URL
> (logon.personal.wamu2u.com) I get an IP address in China.
> 
> Anyone here understand DNS stuff well enough to explain how
> this happens?

Domain names and netblocks have nothing to do with each other.  Two
different hierarchies of agencies are responsible to renting out
those spaces.

> Can anyone else reproduce the results I've listed above?

Yep:

  % dig logon.personal.wamu2u.com
  ;; ANSWER SECTION:
  logon.personal.wamu2u.com.  11h57m IN A  218.202.196.149

  % whois -h WHOIS.APNIC.NET 218.202.196.149
  inetnum:      218.200.0.0 - 218.207.255.255
  netname:      CMNET
  descr:        China Mobile Communications Corporation
  descr:        Mobile Communications Network Operator in China
  descr:        Internet Service Provider in China

-- 
Brian Reichert				<reichert@xxxxxxxxxxx>
37 Crystal Ave. #303			Daytime number: (603) 434-6842
Derry NH 03038-1713 USA			BSD admin/developer at large