My computer does a lot of queries to strange domains such as:


The strange thing is that 56cea5c2b408989ab067adcb787d0f99209bbe07 is the SHA1 of the string "Ebay.com"

Is it a malware? It seems to build hidden queries to well known web site.

---- EDIT ----

This is not the only SHA1 domain prefix that I found, another one exist for "Twitter.com".

Another factor I have to add to the discussion is that when you find an HEX string of length of 16, or 20 is very likely it is an hash. The first thing you can do is a search on Google. There are many web sites that collect hashes (MD5 or SHA1) strings. Try to put the HEX string in google and see :)

  • Okay, exactly how did you figure this one out?
    – Iszi
    Feb 15, 2012 at 22:23
  • How did you know this was the SHA1 of the domain name? Feb 15, 2012 at 22:48
  • 1
    @makerofthings7 There's a webapp for inverting cryptographic hashes (it's also good for a few other things). Feb 15, 2012 at 23:59
  • 1
    @TLDR I can't speak for robob, but I do use Google whenever I investigate something that involves a mysterious 32-digit or 40-digit or 64-digit hex string. Feb 16, 2012 at 0:48
  • 2
    @robob - if you want some more serious answers, I think you should try to provide more details, test a few things etc. Less abstractions, more concrete info.
    – Yoav Aner
    Feb 18, 2012 at 9:23

3 Answers 3


Pure speculation, but I had to give it a try (always fun playing Sherlock Holmes every once in a while - the pre-Hollywood version obviously).

First of all, it's possible, or even likely that .domainname.com is being automatically added by your Operating System. It's quite common to append a domain suffix for DNS queries for a hostname without extesion. My hypothesis is therefore based on the fact that some program simply tried to resolve 56cea5c2b408989ab067adcb787d0f99209bbe07 without any extension. This part of the theory is easy to check on your computer though.

Why would a program try to resolve {something_random} or {hash_of_something}? I am guessing just to test whether name resolution works, and also trying to avoid caching or static /etc/hosts records.

Why hash('ebay.com')? That's the strangest part, but perhaps the developer couldn't figure out a better way to generate a random-like value? so they were just feeding some strings into the hash function? This is the odd part for sure, but there could be a simple explanation (i.e. developer just being stupid/silly/quirky).

  • 1
    I have a hard time imagining doing the request on hash(site) for any reason other than hiding the site name to a casual filter or log reader. (For better stealth, this app should use a salt, if perhaps not PKBDF2 for server-side performance reasons :-) And I have a hard time imagining doing this for a purpose that is neither nefarious nor working around a stupid firewall, and the latter doesn't seem applicable here. Feb 16, 2012 at 0:03
  • hiding the site name however does nothing. Can you resolve a hash(ebay.com) and get a response from the dns server? I don't think so. I tend to think there are far more stupid/naive people doing silly or trying-to-be-clever things than evil hackers doing super-sophisticated stuff. In any case, your guess is probably as good as mine without additional info.
    – Yoav Aner
    Feb 16, 2012 at 9:13

Is this a web browser?

Some browsers limit concurrent connections to 2 when accessing a domain name. A performance hack is to create a wildcard DNS name that resolves to the www site.

The when javascript, or a server side app generates URLs to the server, then more concurrent downloads are permitted.

Is it an app?

In addition, the .NET framework limits outbound connections as well. The developer may not know about system.net.servicepointmanager.defaultconnectionlimit, or how to override this on a per-host or per-appdomain. They may be using a similar hack even though it's not needed.

My guess is that something similar applies to Java, etc...

Lastly, it could be something malicious. It depends...

  • I don't understand how this relates to the question, this may be due to my ignorance about web development. Why would an application make DNS requests to hash(domain_name).domain.com rather than the domain name itself? Feb 15, 2012 at 22:45
  • @Gilles - Performance... then again the value is typically random, not the SHA1 string. Feb 15, 2012 at 22:48
  • Sorry @make... but you have to instruct the DNS to resolve these kind of (random or SHA1) DNS names. How is the DNS instructed to understand this? Can you link some references?
    – robob
    Feb 16, 2012 at 6:27
  • @robob: you just set up a bunch of random-hash subdomains, have them all resolve to the same application on the server: voila, you now have several aliases for your application, allowing you to bypass the per-domain connection limit (you can now make 10 concurrent requests to your server by using 10 different subdomains).
    – tdammers
    Feb 16, 2012 at 6:54
  • mhh, ok so it could be normal to see these log entry with Ebay.com SHA1ed...It's browser capability to overcome the limits...If I have understood you :)
    – robob
    Feb 16, 2012 at 7:33

I would be interested in seeing the file extension, and perhaps the HTTP headers of the site you're mentioning. Is it actually Ebay.com? How can I reproduce this? More detail would be appreciated.

One way this could be useful is to limit the scope of vulnerability for certain "same origin" attacks present in Javascript, Flash, and other brower plug ins.

For example, images infected with Gifar, or infected documents may invoke javascript to "do things" with data on the same DNS domain. A simple way to protect against this is to serve the files from a different DNS domain.


https://96a077f305f5720221b338863ea8e3d7.userfiles.com/tech/SecurityPolicy.docx - OK
https://fd4929a6ea48f85130f5a43f89cb7dd6.userfiles.com/Accounting/budget.xls - OK
https://fd4929a6ea48f85130f5a43f89cb7dd6.userfiles.com/Accounting/Budget.xls  - Fails MD5 Checksum
https://fd4929a6ea48f85130f5a43f89cb7dd6.userfiles.com/Accounting/forecast.xls - Fails MD5 checksum

See some more implementation details here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .