Same IP Address ... Different Web Sites ... How? 1

[TheAceMan1]

Howdy All ...

Co-worker came to me with a problem of [blue]not getting our companies web page[/blue], but [blue]the page of another company[/blue] [purple]with the same name![/purple] This is not suppose to be possible. That name is Sanrex ... aka [blue]sanrex.com[/blue]. Our company deals in high powered equipment, the other in hand tools. I saw the page myself on the coworkers pc so I did a little pinging at their pc. Command line of [blue]ping sanrex.com[/blue] went well, but with a command line of [blue]ping -a 'ipaddress returned by pinging sanrex'[/blue] a different name was returned. We have IT so I left it there.

When I got home curiosity got the best of me so I tried pinging from home (not behind a network):

[blue]When I 'ping sanrex.com' I get the address 64.244.58.214.
When I 'ping -a 64.244.58.214' I get gotresumebuilder.com[/blue]

Thats 3 names!
[ol a][li]Sanrex[/li]
[li]The name from pinging the ipaddress on my co-workers pc (which was not gotresumebuilder.com)[/li]
[li]gotresumebuilder.com from pinging 64.244.58.214 at home[/li][/ol]

It looks like a definite DNS problem to me (not a virus/malware). Can anyone shed any light here? ...

See Ya . . .

Be sure to see FAQ219-2884 Worthy Reading!
Also FAQ181-2886 Worthy Reading!

 

[iggsterman]

Hi there,

Both sanrex.com and

http://www.sanrex.com

appear to point to 64.244.58.214. The name resolution is served by ns1.worldnic.com and ns2.worldnic.com.
web pages retrieved by either names or the ip address appear to bring the Sanrex site. So far so good.
As to the reverse name resolution, that is (in most cases) handled by the ISP owning the subnet. So you are most likely looking at the artifact which does little harm.
In turn, gotresumebuilder.com resolves as 173.192.80.188.

This all should work fine, unless you also run your own SMTP server from that IP address and do not use outside relays.
Anyhow, for the peace of mind, if you choose so, contact your ISP or colo support and request the removal of the PTR record for your very own 64.244.58.214
You have the right to do so.

HTH

 

[TheAceMan1]

iggsterman . . .

I'm not sure what sanrex is using but we are behind a network. However I'm shaky about my results at home (no network). See the following nslookups in DOS:

[blue]C:\Windows\system32>nslookup sanrex.com
Server:  watchmen.dns.rcn.net
Address:  207.172.11.72

Non-authoritative answer:
Name:  sanrex.com
Address:  [purple][b]64.244.58.214[/b][/purple]


C:\Windows\system32>nslookup 64.244.58.214
Server:  watchmen.dns.rcn.net
Address:  207.172.11.72

Non-authoritative answer:
Name:  [purple][b]gotresumebuilder.com[/b][/purple]
Address:  [purple][b]64.244.58.214[/b][/purple]


C:\Windows\system32>nslookup gotresumebuilder.com
Server:  watchmen.dns.rcn.net
Address:  207.172.11.72

Non-authoritative answer:
Name:  gotresumebuilder.com
Address:  [purple][b]173.192.80.188[/b][/purple]


C:\Windows\system32>nslookup 173.192.80.188
Server:  watchmen.dns.rcn.net
Address:  207.172.11.72

Non-authoritative answer:
Name:  [purple][b]gotresumebuilder.com[/b][/purple]
Address:  [purple][b]173.192.80.188[/b][/purple][/blue]

From my browser:
1) sanrex.com works
2) 64.244.58.214 works
3) gotresumebuilder.com works
4) 173.192.80.188 fails with HTTP Error 404 (Not Found)

Also is not the reverse DNS of 64.244.58.214 (gotresumebuilder.com) an ISP error?

[blue]Your Thoughts . . .[/blue]

See Ya . . .

Be sure to see FAQ219-2884 Worthy Reading!
Also FAQ181-2886 Worthy Reading!

 

[iggsterman]

I am not sure what to add. The only thing, in my opinion, that is wrong is that the ISP / colo that owns the 64.244.58.214 address has a stale record resolving to the other company. The data center that hosts sanrex.com owns/leases the IP block. Whoever that is needs to remove the record. No big deal.

 

[TheAceMan1]

iggsterman . . .

Roger That! ...

See Ya . . .

Be sure to see FAQ219-2884 Worthy Reading!
Also FAQ181-2886 Worthy Reading!