Full Disclosure: Re: what is DNS response that 255.255.255.255?

[Pablo Roberto <pabloroberto () gmail com>]

I lauched

ping windowsupdate.daemon.sh it is resolving to a public IP.
PING windowsupdate.daemon.sh (218.18.149.138) 56(84) bytes of data.

The whois:

inetnum:      218.13.0.0 - 218.18.255.255
netname:      CHINANET-GD
descr:        CHINANET Guangdong province network
descr:        Data Communication Division
descr:        China Telecom
country:      CN


http://www.vsantivirus.com/mofei-c.htm


At this web site are showing something different but the virus is using
the same DNS Resolution.

Do you see anything else?
Could you tell me more about your tests?

Regards,




El mar, 17-03-2009 a las 17:52 +0900, 김무성 escribió:
> Hello.
>
>  
>
> I’m testing malware.
>
> It DNS query xxxxxxxxxxx.ods.org and xxxxxxxxx.daemon.sh
>
> And response is 255.255.255.255
>
>  
>
> What is 255.255.255.255?
>
> Can DNS hosting company set that specific DNS name set to
> 255.255.255.255?
>
>  
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/