1

Could someone please explain to the results of a reverse DNS lookup I ran? dig -x 17.178.96.59

I was expecting apple.com but it also listed a whole load of PTR's. Many looked like phishing sites like icloudc.om and jtunes.com for instance. All have a very high TTL as well.

  • icloudc.om does not exists, but several other variations do. – Alexander O'Mara Apr 26 '16 at 4:14
2

This simply means that all these domain names are associated with the IP 17.178.96.59.

Several domain names can be associated with the same IP address. This is common with name-based implementation of Shared web hosting service:

Name-based

In name-based virtual hosting, also called shared IP hosting, the virtual hosts serve multiple host names on a single machine with a single IP address. This is possible because when a web browser requests a resource from a web server using HTTP/1.1 it includes the requested host name as part of the request. The server uses this information to determine which web site to show the user.

Source: Name-based - Shared web hosting service (Wikipedia)

(Emphasis is mine)

In your particular case, all these domain names seems to belong to Apple; it's not surprising as Apple have to reason to share that single IP with anyone else. As of today, it looks like they all redirect you to the Apple webpage, but they could have done it otherwise. You could have got different website with these domain names, even though they are associated with the same IP.

As schroeder said, one reason to register several domain names that looks similar is to avoid phishing or brand abuse (e.g. typosquatting). I would like to add that another reason can be to correct user mistakes (e.g. https://googl.com/ redirects me to https://google.com/).

Note that my last paragraph doesn't involve that these domain names are associated with the same IP. My example with googl.com and googl.com shows it. But it's possible.

PS: You mention the domain name 12diasdepresentesdeitunes.com.br, I don't get it when I type your command, so I can't comment on that.

| improve this answer | |
1

Sometimes, companies will register domain names that are similar to their actual domain names or products to make sure someone does not use them for phishing or brand abuse.

This can be confirmed by running a whois query. I see that jtunes.com is, in fact, registered by Apple.

http://www.tcpiputils.com/browse/domain/jtunes.com

| improve this answer | |
  • I thought that might be the case but one of the PTR's is 12diasdepresentesdeitunes.com.br which shows as resolving to 165.160.13.20 – 13uz Apr 26 '16 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.