12

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious if anyone has any insight for what this message could mean.

enter image description here

The contents of the message contain an IP address and TCP port. When checking the IP address on ip-tracker.org, it reveals that the IP address belongs to the ISP of the US Department of Defense. Referring to the IP block on http://www.ispinfo.net/isp/6.216.198.html reveals that the ISP is specifically part of the USAISC, which is the United States Army Intelligence and Security Command.

IP lookup

Pinging the IP address fails, and I'm unsure what the random sequence of numbers following the IP address could mean. Is this message from or directed to the Department of Defense? Any assistance deciphering the meaning or origin of this message would be appreciated. Thanks!

Improve this question
1
  • @Shiji.Jiang Really? If that were the case, why do they even need to have an actual address range? Why couldn't they use one of the many addresses available in, say, 10.0.0.0/8? I find it hard to believe that they would somehow abuse external addresses as internal addresses.
    – forest
    Jun 20, 2018 at 13:03

1 Answer 1

Reset to default
29
+50

I don't believe you (or anyone else) is targeted by the US Department of Defense. More plausibly, AT&T screwed up something on their server.

A very quick research on the number 1111301000 returns this article which seemingly sent by AT&T.

Regarding the number 6.216.198.5, it's a coincidence that a substring of AT&T's IP address pointed to the US Department of Defense. Searching that exact number returned a bug report "cannot receive MMS using AT+T" on Ubuntu's launchpad which contained

00000000 01 06 27 61 70 70 6c 69 63 61 74 69 6f 6e 2f 76 |..'application/v|
00000010 6e 64 2e 77 61 70 2e 6d 6d 73 2d 6d 65 73 73 61 |nd.wap.mms-messa|
00000020 67 65 00 af 84 8d 01 81 b4 84 8c 82 98 41 36 30 |ge...........A60|
00000030 35 32 38 31 33 32 39 31 31 35 30 30 30 31 38 30 |5281329115000180|
00000040 30 30 30 35 30 30 30 30 00 8d 90 89 18 80 2b 31 |00050000......+1|
00000050 36 31 37 36 39 39 30 36 35 35 2f 54 59 50 45 3d |6176990655/TYPE=|
00000060 50 4c 4d 4e 00 96 02 ea 00 8a 80 8e 02 80 00 88 |PLMN............|
00000070 05 81 03 05 46 00 83 68 74 74 70 3a 2f 2f 31 36 |....F..http://16|
00000080 36 2e 32 31 36 2e 31 39 38 2e 35 3a 38 30 30 38 |6.216.198.5:8008|
00000090 2f 30 35 32 38 31 33 32 39 31 31 35 30 30 30 31 |/052813291150001|

Note the last 2 lines: it contained a similar pattern 6.216.198.5:8008/<long string of number>. However, the line before that contained http://16, which means it's actually pointing to http://166.216.198.5. That IP address is actually owned by AT&T Wireless.

Improve this answer
4
  • That makes so much more sense! Definitely something screwed up on their end.
    – forest
    Mar 30, 2018 at 4:07
  • At&t, years ago was the carrier for the DOD, and hosted their network. They might still have that relationship.
    – user218076
    Jun 20, 2018 at 4:56
  • @user218076 Source for that?
    – user173641
    Jun 21, 2018 at 10:06
  • 2
    @JoshuaJones link link link
    – user218076
    Jun 21, 2018 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .