I was recently flummoxed by an issue related to me setting my router's static DNS servers to what I understand to be Level 3 DNS servers, (184.108.40.206, 220.127.116.11, etc.).
For work I use a company VPN. On the VPN are various hosts that I ssh into to perform various work related tasks. Sometimes my VPN client will drop my connection, rarely. When my VPN connection is up the client sets things up so that my computer uses the company DNS server to resolve hosts. When the VPN is down my router acts as my DNS server.
Let's say one of the hosts that I ssh into is called
Recently my VPN connection went down and I didn't notice. I tried to ssh into
internal.server and I got a ssh spoofing error. The key in my
~/.ssh/known_hosts file did not match the key that was presented by
To make a long story short, I realized that the 18.104.22.168 etc. DNS servers (which get used when my VPN connection is down) resolve just about anything that's not valid to 22.214.171.124.
$ nslookup blah.blah 126.96.36.199 Server: 188.8.131.52 Address: 184.108.40.206#53 Non-authoritative answer: Name: blah.blah Address: 220.127.116.11 Name: blah.blah Address: 18.104.22.168
I have no idea what 22.214.171.124 is, but they're running an ssh server on port 22.
And finally, my actual questions:
Why do the Level 3 DNS servers resolve (literally)
blah.blah (and just about any other
invalid.domain I can think of) to that IP address? Couldn't the host at 126.96.36.199 be doing all sorts of horrible spoofing things to people that made typos in their host names?
Am I missing something?