?? HTTP://AI/

2 points by vladletter 6 years ago | 1 comment

http://ai/

susam 6 years ago |

Clickable URL: http://ai/

  $ host ai
  ai.domain.name has address 78.47.226.171
  ai.domain.name mail is handled by 10 mail.ai.domain.name.

  $ curl -I -H 'User-Agent: Mozilla/5.0' http://ai/
  HTTP/1.1 302 Found
  Server: nginx/1.10.3
  Date: Fri, 14 Feb 2020 15:51:14 GMT
  Content-Type: text/html; charset=UTF-8
  Connection: keep-alive
  Location: https://geebun.com/?dn=ai&ref=&uri=/

Also, see http://in/, http://io/, http://cc/, http://us/, etc.

When we try to resolve an unqualified domain name, a DNS query is sent with ".domain.name" automatically appended to the name. For example, see the following tcpdump output when I ping ai:

  $ sudo tcpdump -nn 'port 53'
  tcpdump: data link type PKTAP
  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
  21:51:06.822893 IP 192.168.1.11.64760 > 8.8.8.8.53: 40086+ PTR? b._dns-sd._udp.0.1.168.192.in-addr.arpa. (57)
  21:51:06.822929 IP 192.168.1.11.59962 > 8.8.8.8.53: 41423+ PTR? db._dns-sd._udp.0.1.168.192.in-addr.arpa. (58)
  21:51:06.822956 IP 192.168.1.11.54686 > 8.8.8.8.53: 16314+ PTR? lb._dns-sd._udp.0.1.168.192.in-addr.arpa. (58)
  21:51:06.823008 IP 192.168.1.11.59973 > 8.8.8.8.53: 31333+ PTR? b._dns-sd._udp.domain.name. (44)
  21:51:06.823051 IP 192.168.1.11.61283 > 8.8.8.8.53: 19596+ PTR? db._dns-sd._udp.domain.name. (45)
  21:51:06.823081 IP 192.168.1.11.64543 > 8.8.8.8.53: 20062+ PTR? lb._dns-sd._udp.domain.name. (45)
  21:51:06.829440 IP 192.168.1.11.50120 > 8.8.8.8.53: 56284+ A? ai.domain.name. (32)
  21:51:06.837374 IP 8.8.8.8.53 > 192.168.1.11.64760: 40086 NXDomain 0/0/0 (57)
  21:51:06.845235 IP 8.8.8.8.53 > 192.168.1.11.59962: 41423 NXDomain 0/0/0 (58)
  21:51:06.845241 IP 8.8.8.8.53 > 192.168.1.11.54686: 16314 NXDomain 0/0/0 (58)
  21:51:06.845244 IP 8.8.8.8.53 > 192.168.1.11.64543: 20062 NXDomain 0/1/0 (112)
  21:51:06.845246 IP 8.8.8.8.53 > 192.168.1.11.59973: 31333 NXDomain 0/1/0 (111)
  21:51:06.845247 IP 8.8.8.8.53 > 192.168.1.11.61283: 19596 NXDomain 0/1/0 (112)
  21:51:07.142844 IP 8.8.8.8.53 > 192.168.1.11.50120: 56284 1/0/0 A 78.47.226.171 (48)

$ host ai ai.domain.name has address 78.47.226.171 ai.domain.name mail is handled by 10 mail.ai.domain.name. $ curl -I -H 'User-Agent: Mozilla/5.0' http://ai/ HTTP/1.1 302 Found Server: nginx/1.10.3 Date: Fri, 14 Feb 2020 15:51:14 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive Location: https://geebun.com/?dn=ai&ref=&uri=/

$ sudo tcpdump -nn 'port 53' tcpdump: data link type PKTAP tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes 21:51:06.822893 IP 192.168.1.11.64760 > 8.8.8.8.53: 40086+ PTR? b._dns-sd._udp.0.1.168.192.in-addr.arpa. (57) 21:51:06.822929 IP 192.168.1.11.59962 > 8.8.8.8.53: 41423+ PTR? db._dns-sd._udp.0.1.168.192.in-addr.arpa. (58) 21:51:06.822956 IP 192.168.1.11.54686 > 8.8.8.8.53: 16314+ PTR? lb._dns-sd._udp.0.1.168.192.in-addr.arpa. (58) 21:51:06.823008 IP 192.168.1.11.59973 > 8.8.8.8.53: 31333+ PTR? b._dns-sd._udp.domain.name. (44) 21:51:06.823051 IP 192.168.1.11.61283 > 8.8.8.8.53: 19596+ PTR? db._dns-sd._udp.domain.name. (45) 21:51:06.823081 IP 192.168.1.11.64543 > 8.8.8.8.53: 20062+ PTR? lb._dns-sd._udp.domain.name. (45) 21:51:06.829440 IP 192.168.1.11.50120 > 8.8.8.8.53: 56284+ A? ai.domain.name. (32) 21:51:06.837374 IP 8.8.8.8.53 > 192.168.1.11.64760: 40086 NXDomain 0/0/0 (57) 21:51:06.845235 IP 8.8.8.8.53 > 192.168.1.11.59962: 41423 NXDomain 0/0/0 (58) 21:51:06.845241 IP 8.8.8.8.53 > 192.168.1.11.54686: 16314 NXDomain 0/0/0 (58) 21:51:06.845244 IP 8.8.8.8.53 > 192.168.1.11.64543: 20062 NXDomain 0/1/0 (112) 21:51:06.845246 IP 8.8.8.8.53 > 192.168.1.11.59973: 31333 NXDomain 0/1/0 (111) 21:51:06.845247 IP 8.8.8.8.53 > 192.168.1.11.61283: 19596 NXDomain 0/1/0 (112) 21:51:07.142844 IP 8.8.8.8.53 > 192.168.1.11.50120: 56284 1/0/0 A 78.47.226.171 (48)