I noticed a very strange entry in my Apache logs, with a domain name of
just "test".

"dig test" failed, as you might expect, so I used netstat -aln to read
the connected IP addresses. The address is 195.144.130.1, and "dig -x
195.144.130.1 gives the output below. What's this all about?! Who's
setting up their own TLDs?

Hold on, a black helicopter's just landed outside. Back in a minute...

mark@mauve:~$ dig -x 195.144.130.1

; <<>> DiG 9.2.3 <<>> -x 195.144.130.1
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64132
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;1.130.144.195.in-addr.arpa. IN PTR

;; ANSWER SECTION:
1.130.144.195.in-addr.arpa. 6276 IN PTR test.

;; AUTHORITY SECTION:
130.144.195.in-addr.arpa. 6276 IN NS ns2.uk.cw.net.
130.144.195.in-addr.arpa. 6276 IN NS ns3.uk.cw.net.
130.144.195.in-addr.arpa. 6276 IN NS ns0.uk.cw.net.
130.144.195.in-addr.arpa. 6276 IN NS ns1.uk.cw.net.

;; ADDITIONAL SECTION:
ns0.uk.cw.net. 29105 IN A 194.177.160.6
ns1.uk.cw.net. 29105 IN A 194.177.170.35
ns2.uk.cw.net. 29105 IN A 194.6.79.4
ns3.uk.cw.net. 29105 IN A 195.224.151.84

;; Query time: 26 msec
;; SERVER: 192.168.7.3#53(192.168.7.3)
;; WHEN: Mon Oct 4 12:18:24 2004
;; MSG SIZE rcvd: 207


--
Mark.
http://tranchant.plus.com/