132

I recently set up NextDNS on my personal devices to further reduce the amount of tracking and ads I'm exposed to. The service comes with built-in analytics that shows a brief overview of your network activity.

Most of the top hits are uninteresting, however there's one domain I couldn't figure out:

Overview of DNS statistics

What's the domain fhepfcelehfcepfffacacacacacacabn?
The seemingly random string gives roughly two pages of Google results, but none of them seem to hold any useful information.

The log table says the entry is a DNS record of type NIMLOC, but that seems like another dead end inquiry-wise.

8
  • For more background information, I'm a developer, hence the localhost entries. I also have a number of Chrome extensions, although I can't find a way to confirm nor deny whether they're linked to the domain.
    – Etheryte
    Mar 29 '20 at 14:16
  • 16
    That string also shows up in Google results in a wireshark log posted in 2009, related to a samba bug ( bugzilla.samba.org/attachment.cgi?id=4050&action=edit ). So that string is probably not random, it probably means or refers to something.
    – reed
    Mar 29 '20 at 14:38
  • 3
    It appears to be some message of NETBIOS Protocol, and maybe your analyser is working on a packet inspection level and picking it as a domain, either ways, this is more of a networking question, check this link: elitepvpers.com/forum/sro-private-server/…
    – Emadeddin
    Mar 29 '20 at 16:15
  • I'm not sure what this has to do with information security? Mar 29 '20 at 21:14
  • 6
    @ConorMancone At first, I suspected this to be requests from rogue software or something else of the kind installed on my system, especially given the garbage domain. Further inquiry revealed this was not the case.
    – Etheryte
    Mar 29 '20 at 22:55
254

That domain is an encoded form of the string "WORKGROUP". It is using a variant of hex encoding that uses the letters A-P, instead of the numbers 0-9 followed by A-F.

$ echo fhepfcelehfcepfffacacacacacacabn |
  tr a-p 0-9a-f |
  xxd -r -p |
  xxd

00000000: 574f 524b 4752 4f55 5020 2020 2020 201d  WORKGROUP      .

This appears to be a NetBIOS name, which is why it's padded with spaces to 15 ASCII characters, and then followed by a different character at the end as a suffix. The hex encoding is described in the NetBIOS-over-TCP/UDP Concepts RFC, called "first level encoding". Also, NetBIOS uses DNS record type ID 32 for its "name service" packets; that ID was later allocated to NIMLOC (ref), which explains that part of the log. However I'm not sure exactly what software on your machine is making this DNS query; if you're using Windows, it seems likely to be something at the OS level.

I don't believe the answer from NextDNS support is correct here about the source of this particular query—it is probably not coming from Chrome.

7
  • 6
    Oh, this is super interesting, and a way more revealing than the original answer by the support. How did you figure the letter switch out?
    – Etheryte
    Mar 30 '20 at 11:11
  • 39
    Just a hunch. That repeated CA pattern looked suspicious, and there were no letters from the end of the alphabet; those things to me suggested an alternate hex encoding.
    – Miles
    Mar 30 '20 at 11:16
  • 8
    I left Wireshark recording and the log entries indeed coincide with NBNS requests on port 137. The source of the requests was usr/sbin/netbiosd, which is turned on out-of-the-box on Macs.
    – Etheryte
    Mar 30 '20 at 15:30
  • 16
    This looks like a typical answer on puzzling.stackexchange.com
    – mafu
    Mar 31 '20 at 9:00
  • 5
    @DavidConrad While true, it doesn't have that meaning in this context; see the section of the NetBIOS Wikipedia page about suffixes.
    – Miles
    Mar 31 '20 at 17:45
35

Update: This answer by Miles is a better insight, the explanation given by NextDNS support seems wrong.


I contacted NextDNS support asking for more details and they said this is Google Chrome testing internet connectivity.

Knowing where to look, I found numerous references for the same behavior: This article from 2012 discusses the mechanics with similar jumbled domains, albeit shorter strings. This Chromium ticket from 2010 reports a bug in the related behavior and also shows similar garbage domains.

In conclusion, this seems safe, albeit unexpected.

3
  • 10
    Doesn't seem safe to me. Seems ripe for hacking.
    – LabGecko
    Mar 29 '20 at 23:24
  • 3
    @LabGecko Well that probably depends to a large extent on what (if anything) gets done with the DNS response after it comes back to the phone.
    – David Z
    Mar 29 '20 at 23:53
  • It seems likely that if it's Chrome then others should be able to reproduce. I would expect that the random domains are unique to users, this may be of interest to privacy-concerned users. Apr 1 '20 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.