In today's log summary from my SSH server, I found the following interesting entry:

Illegal users from: (localhost): 2 times

Doing a DNS lookup on does indeed resolve to localhost (a DNS lookup of localhost resolves to, as expected). What could an attacker be trying to do with such an obviously-invalid DNS record?

1 Answer 1


An attacker could try to bypass a hostname-based whitelist on your server.

In a naive scenario, you might configure SSH or a firewall to only allow connections from "localhost", intending to lock out all remote machines for security reasons.

A smart SSH server would recognize that is remote and block the connection attempt. Eventually, it would resolve localhost to and see that the IPs don't match.

However, a server with a flawed implementation might first conduct a reverse DNS lookup of the IP, find the localhost entry, and reason that the hostnames match, thus allowing the connection.

NB: Resolving localhost to is obviously done internally in most cases, skipping the DNS query (e.g. by looking it up in /etc/hosts). Hence, a malicious DNS server cannot easily attack the other way round by resolving localhost to an arbitrary IP.

Why does that particular IP resolve to localhost?

Here, it's likely not part of an attack, but because that IP is located in Hanoi and apparently, "The Country of Vietnam Resolves to Localhost". The reason seems to be an outdated technique to bypass e-mail spam filters.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .