I was recently flummoxed by an issue related to me setting my router's static DNS servers to what I understand to be Level 3 DNS servers, (4.2.2.1, 4.2.2.2, etc.).
For work I use a company VPN. On the VPN are various hosts that I ssh into to perform various work related tasks. Sometimes my VPN client will drop my connection, rarely. When my VPN connection is up the client sets things up so that my computer uses the company DNS server to resolve hosts. When the VPN is down my router acts as my DNS server.
Let's say one of the hosts that I ssh into is called internal.server
Recently my VPN connection went down and I didn't notice. I tried to ssh into internal.server
and I got a ssh spoofing error. The key in my ~/.ssh/known_hosts
file did not match the key that was presented by internal.server
To make a long story short, I realized that the 4.2.2.1 etc. DNS servers (which get used when my VPN connection is down) resolve just about anything that's not valid to 23.202.231.167.
For example:
$ nslookup blah.blah 4.2.2.1
Server: 4.2.2.1
Address: 4.2.2.1#53
Non-authoritative answer:
Name: blah.blah
Address: 23.217.138.108
Name: blah.blah
Address: 23.202.231.167
I have no idea what 23.202.231.167 is, but they're running an ssh server on port 22.
And finally, my actual questions:
Why do the Level 3 DNS servers resolve (literally) blah.blah
(and just about any other invalid.domain
I can think of) to that IP address? Couldn't the host at 23.202.231.167 be doing all sorts of horrible spoofing things to people that made typos in their host names?
Am I missing something?