Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Could someone please explain to the results of a reverse DNS lookup I ran? dig -x 17.178.96.59

I was expecting apple.com but it also listed a whole load of PTR's. Many looked like phishing sites like icloudc.om and jtunes.com for instance. All have a very high TTL as well.

share|improve this question
    
icloudc.om does not exists, but several other variations do. – Alexander O'Mara Apr 26 at 4:14

This simply means that all these domain names are associated with the IP 17.178.96.59.

Several domain names can be associated with the same IP address. This is common with name-based implementation of Shared web hosting service:

Name-based

In name-based virtual hosting, also called shared IP hosting, the virtual hosts serve multiple host names on a single machine with a single IP address. This is possible because when a web browser requests a resource from a web server using HTTP/1.1 it includes the requested host name as part of the request. The server uses this information to determine which web site to show the user.

Source: Name-based - Shared web hosting service (Wikipedia)

(Emphasis is mine)

In your particular case, all these domain names seems to belong to Apple; it's not surprising as Apple have to reason to share that single IP with anyone else. As of today, it looks like they all redirect you to the Apple webpage, but they could have done it otherwise. You could have got different website with these domain names, even though they are associated with the same IP.

As schroeder said, one reason to register several domain names that looks similar is to avoid phishing or brand abuse (e.g. typosquatting). I would like to add that another reason can be to correct user mistakes (e.g. https://googl.com/ redirects me to https://google.com/).

Note that my last paragraph doesn't involve that these domain names are associated with the same IP. My example with googl.com and googl.com shows it. But it's possible.

PS: You mention the domain name 12diasdepresentesdeitunes.com.br, I don't get it when I type your command, so I can't comment on that.

share|improve this answer

Sometimes, companies will register domain names that are similar to their actual domain names or products to make sure someone does not use them for phishing or brand abuse.

This can be confirmed by running a whois query. I see that jtunes.com is, in fact, registered by Apple.

http://www.tcpiputils.com/browse/domain/jtunes.com

share|improve this answer
    
I thought that might be the case but one of the PTR's is 12diasdepresentesdeitunes.com.br which shows as resolving to 165.160.13.20 – 13uz Apr 26 at 4:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.