朋友說(shuō) (15:08):
方便的話，你訪問(wèn)當(dāng)年明月的 blog http://blog.sina.com.cn/m/dangnianmingyue
用sniffer看看是不是會(huì)去下載一個(gè) www.jcdh.cn/1.exe 的文件。我這只要一訪問(wèn)這個(gè)頁(yè)面就下載這個(gè)病毒。其他頁(yè)面沒(méi)事。
我不能確定是我的機(jī)器中毒了還是這個(gè)頁(yè)面有問(wèn)題。

精于心，簡(jiǎn)于形[鄭昀] 說(shuō) (15:15):
http://www.xfocus.net/articles/200610/888.html ，這里面談到了。
“兩年前,訪問(wèn)網(wǎng)站的時(shí)候經(jīng)常被重定位到北京寬帶智能糾錯(cuò)網(wǎng)站去，比較煩人。
后來(lái)一段時(shí)間好象也沒(méi)有了，也就沒(méi)有注意了。這幾天，訪問(wèn)網(wǎng)站的時(shí)候又經(jīng)常出現(xiàn)
一些奇怪的現(xiàn)象。初步判斷網(wǎng)絡(luò)有點(diǎn)問(wèn)題，當(dāng)然我能確保我的系統(tǒng)是干凈的。
”

jcdh.cn whois 信息
Domain Name???? jcdh.cn
Domain Status??? ok
Registrant Name??? 呂先生
Administrative Email??? dayu2008@163.com
Sponsoring Registrar??? 北京萬(wàn)網(wǎng)志成科技有限公司
Name Server??? dns11.hichina.com
Name Server??? dns12.hichina.com
Registration Date??? 2006-09-15 14:11
Expiration Date??? 2007-09-15 14:11?

朋友說(shuō):
是。我正在看xfocus那個(gè)文章，幾天前看到過(guò)。
精于心，簡(jiǎn)于形[鄭昀] 說(shuō):
我前幾個(gè)月原來(lái)說(shuō)過(guò)這個(gè)問(wèn)題，典型的流氓手段。
朋友?說(shuō):
是，我看過(guò)你那個(gè)文章。就是互聯(lián)星空捆綁最熱的時(shí)候。
精于心，簡(jiǎn)于形[鄭昀] 說(shuō):
這回可能還是他們。和你的系統(tǒng)無(wú)關(guān)。

技術(shù)人員請(qǐng)看下面的xfocus討論：

誰(shuí)動(dòng)了我們的DNS

創(chuàng)建時(shí)間：2006-10-15 更新時(shí)間：2006-10-15
文章屬性：轉(zhuǎn)載
文章來(lái)源：internet
文章提交： root (webmaster_at_xfocus.org)

誰(shuí)動(dòng)了我們的DNS

2006-10-16
by 81d83889fb4a54b0d5d7e07d42c51422

本文遵從GPL協(xié)議，歡迎轉(zhuǎn)載

|=------------------------------------------------------------------------=|

---------[ Table of Contents ]

??0x1?? - 前言
??0x2?? - 一些怪現(xiàn)象
????0x2.1?? --????ping一些不存在的域名
????0x2.2?? --????抓包分析
??0x3????- 瀏覽器瀏覽不存在域名被重定位
????0x3.1?? --????現(xiàn)象
????0x3.2?? --????抓包分析
??0x4????- xxxxxx.bobodogs.com的統(tǒng)計(jì)數(shù)據(jù)
??0x5????- www.bobodogs.com 的統(tǒng)計(jì)數(shù)據(jù)
??0x6????- 一次被引導(dǎo)到3721網(wǎng)站的過(guò)程
??0x7????- 有必要看下 www.jcdh.cn 這個(gè)網(wǎng)站
??0x8????- 小結(jié)
????0x8.1?? --????影響用戶范圍
????0x8.2?? --????解決辦法

|=------------------------------------------------------------------------=|

---------[ 0x1 - 前言 ]

一兩年前,訪問(wèn)網(wǎng)站的時(shí)候經(jīng)常被重定位到北京寬帶智能糾錯(cuò)網(wǎng)站去，比較煩人。
后來(lái)一段時(shí)間好象也沒(méi)有了，也就沒(méi)有注意了。這幾天，訪問(wèn)網(wǎng)站的時(shí)候又經(jīng)常出現(xiàn)
一些奇怪的現(xiàn)象。初步判斷網(wǎng)絡(luò)有點(diǎn)問(wèn)題，當(dāng)然我能確保我的系統(tǒng)是干凈的。

使用環(huán)境 winxp sp2 firefox，北京網(wǎng)通ADSL撥號(hào)上網(wǎng)，使用DHCP自動(dòng)分配IP和獲得DNS，
不使用IE是因?yàn)镮E自身也內(nèi)嵌了3721查詢，正確的說(shuō)是內(nèi)嵌了auto.search.msn.com.

關(guān)鍵字：DNS查詢，HTTP協(xié)議，WHOIS 查詢，DNS輪循

---------[ 0x2 - 一些怪現(xiàn)象 ]

這里就不重述DNS是如何工作的，以及DNS在整個(gè)互聯(lián)網(wǎng)中的重要性。

---------[ 0x2.1 - ping一些不存在的域名 ]

先來(lái)看看一些現(xiàn)象：
======================================================================
ping fuck12334566.com

Pinging fuck12334566.com [202.108.251.209] with 32 bytes of data:

Reply from 202.108.251.209: bytes=32 time=17ms TTL=247
Reply from 202.108.251.209: bytes=32 time=16ms TTL=247

Ping statistics for 202.108.251.209:
????Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
????Minimum = 16ms, Maximum = 17ms, Average = 16ms
Control-C
^C
ping fuck12334566.com

Pinging fuck12334566.com [202.108.251.209] with 32 bytes of data:

Reply from 202.108.251.209: bytes=32 time=15ms TTL=247

Ping statistics for 202.108.251.209:
????Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
????Minimum = 15ms, Maximum = 15ms, Average = 15ms
Control-C
^C
ping fuck12334567.com

Pinging fuck12334567.com [202.108.251.209] with 32 bytes of data:

Reply from 202.108.251.209: bytes=32 time=17ms TTL=247

Ping statistics for 202.108.251.209:
????Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
????Minimum = 17ms, Maximum = 17ms, Average = 17ms
Control-C
^C
ping fuck12334568.com

Pinging fuck12334568.com [202.108.251.207] with 32 bytes of data:

Reply from 202.108.251.207: bytes=32 time=18ms TTL=247
Reply from 202.108.251.207: bytes=32 time=17ms TTL=247

Ping statistics for 202.108.251.207:
????Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
????Minimum = 17ms, Maximum = 18ms, Average = 17ms
Control-C
^C
ping fuck12334569.com

Pinging fuck12334569.com [202.108.251.209] with 32 bytes of data:

Reply from 202.108.251.209: bytes=32 time=16ms TTL=247

Ping statistics for 202.108.251.209:
????Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
????Minimum = 16ms, Maximum = 16ms, Average = 16ms
Control-C
^C
ping fuck12334570.com

Pinging fuck12334570.com [202.108.251.206] with 32 bytes of data:

Reply from 202.108.251.206: bytes=32 time=16ms TTL=247

Ping statistics for 202.108.251.206:
????Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
????Minimum = 16ms, Maximum = 16ms, Average = 16ms
Control-C
^C
ping fuck12334571.com

Pinging fuck12334571.com [202.108.251.209] with 32 bytes of data:

Reply from 202.108.251.209: bytes=32 time=17ms TTL=247

Ping statistics for 202.108.251.209:
????Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
????Minimum = 17ms, Maximum = 17ms, Average = 17ms
Control-C
======================================================================

為什么會(huì)這樣，明名胡亂打的一個(gè)域名為什么會(huì)返回一系列IP地址呢，是偶然
還是巧合?

dns服務(wù)器返回的一些ip地址
202.108.251.209
202.108.251.206
202.108.251.207
202.108.251.213

===============================================================
inetnum:??????202.108.0.0 - 202.108.255.255
netname:??????CNCGROUP-BJ
descr:????????CNCGROUP Beijing province network
descr:????????China Network Communications Group Corporation
descr:????????No.156,Fu-Xing-Men-Nei Street,
descr:????????Beijing 100031
country:??????CN
admin-c:??????CH455-AP
tech-c:?????? SY21-AP
mnt-by:?????? APNIC-HM
mnt-lower:????MAINT-CNCGROUP-BJ
mnt-routes:?? MAINT-CNCGROUP-RR
changed:??????hm-changed@apnic.net 20031017
status:?????? ALLOCATED PORTABLE
changed:??????hm-changed@apnic.net 20060124
source:?????? APNIC

role:???????? CNCGroup Hostmaster
e-mail:?????? abuse@cnc-noc.net
address:??????No.156,Fu-Xing-Men-Nei Street,
address:??????Beijing,100031,P.R.China
nic-hdl:??????CH455-AP
phone:????????+86-10-82993155
fax-no:?????? +86-10-82993102
country:??????CN
admin-c:??????CH444-AP
tech-c:?????? CH444-AP
changed:??????abuse@cnc-noc.net 20041119
mnt-by:?????? MAINT-CNCGROUP
source:?????? APNIC

person:?????? sun ying
address:??????fu xing men nei da jie 97, Xicheng District
address:??????Beijing 100800
country:??????CN
phone:????????+86-10-66030657
fax-no:?????? +86-10-66078815
e-mail:?????? suny@publicf.bta.net.cn
nic-hdl:??????SY21-AP
mnt-by:?????? MAINT-CNCGROUP-BJ
changed:??????suny@publicf.bta.net.cn 19980824
changed:??????hm-changed@apnic.net 20060717
source:?????? APNIC

===============================================================

---------[ 0x2.2 - 抓包分析 ]

抓包分析下

===============================================================
Frame 3 (93 bytes on wire, 93 bytes captured)
Ethernet II, Src: Vmware_fc:4e:c4 (00:50:56:fc:4e:c4), Dst: Vmware_2b:e7:dd (00:0c:29:2b:e7:dd)
Internet Protocol, Src: 192.168.174.2 (192.168.174.2), Dst: 192.168.174.132 (192.168.174.132)
User Datagram Protocol, Src Port: domain (53), Dst Port: 1326 (1326)
Domain Name System (response)
????Transaction ID: 0xc627
????Flags: 0x8180 (Standard query response, No error)
????Questions: 1
????Answer RRs: 1
????Authority RRs: 0
????Additional RRs: 0
????Queries
????????fuck123445452.com: type A, class IN
????????????Name: fuck123445452.com
????????????Type: A (Host address)
????????????Class: IN (0x0001)
????Answers
????????fuck123445452.com: type A, class IN, addr 202.108.251.213
????????????Name: fuck123445452.com
????????????Type: A (Host address)
????????????Class: IN (0x0001)
????????????Time to live: 1 minute
????????????Data length: 4
????????????Addr: 202.108.251.213

===============================================================
很顯然dns服務(wù)器告訴我們的就是：fuck123445452.com的ip地址為202.108.251.213

---------[ 0x3 - 瀏覽器瀏覽不存在域名被重定位 ]

---------[ 0x3.1 - 現(xiàn)象 ]

??再來(lái)看看http協(xié)議上的問(wèn)題，我們用firefox敲了一個(gè)網(wǎng)址進(jìn)去
www.chinatesttesttest.com (特意查了下，這個(gè)域名是還沒(méi)有被人注冊(cè)的) ,
結(jié)果返回回來(lái)的是
===============================================================
無(wú)法顯示網(wǎng)頁(yè)
您正在查找的頁(yè)當(dāng)前不可用。網(wǎng)站可能遇到支持問(wèn)題，或者您需要調(diào)整您的瀏覽器
設(shè)置。

請(qǐng)嘗試以下操作:

????* ·單擊 refresh.gif (82 字節(jié)) 刷新按鈕，或稍后重試。
????* ·如果您已經(jīng)在地址欄中輸入該網(wǎng)頁(yè)的地址，請(qǐng)確認(rèn)其拼

==============================================================
是不是覺(jué)得奇怪呢，是的，不奇怪才怪了呢

---------[ 0x3.2 - 抓包分析 ]

抓包分析吧

firefox的動(dòng)作

★ 第一步
??查詢 www.chinatesttesttest.com 的ip地址，如上一樣dns服務(wù)器返回
??202.108.251.215

★ 第二步
??2.1 向202.108.251.215發(fā)送GET / HTTP/1.1\r\n請(qǐng)求。
??2.2 202.108.251.215返回?cái)?shù)據(jù)

===============================================================
Hypertext Transfer Protocol
Line-based text data: text/html
????<html>
????<head>
????<style>body{margin:0px;padding:0px;overflow:hidden;}</style>
????
????</head>
????<body>
????????????<iframe name="iframe0" src=" http://www.jcdh.cn/1.html?url=www.chinatesttestest.com/" WIDTH="100%" HEIGHT="100%" FRAMEBORDER="0" />
????
????
????</body>
????</html>
????
===============================================================

ok這里出現(xiàn)了bobodogs.com和jcdh.cn這兩個(gè)網(wǎng)站。
看看這兩個(gè)網(wǎng)站分別是什么
jcdh.cn是北京寬帶網(wǎng)網(wǎng)站。(后補(bǔ)：是乍看是)
bobodogs.com是博博狗。
他們倆什么關(guān)系？？

===============================================================
jcdh.cn whois 信息

Domain Name???? jcdh.cn
Domain Status????ok
Registrant Name????呂先生
Administrative Email????dayu2008@163.com
Sponsoring Registrar????北京萬(wàn)網(wǎng)志成科技有限公司
Name Server????dns11.hichina.com
Name Server????dns12.hichina.com
Registration Date????2006-09-15 14:11
Expiration Date????2007-09-15 14:11

===============================================================
bobodogs whois 信息

?? Domain Name: BOBODOGS.COM
?? Registrar: HICHINA WEB SOLUTIONS (HONG KONG) LIMITED
?? Whois Server: grs.hichina.com
?? Referral URL: http://whois.hichina.com
?? Name Server: DNS12.HICHINA.COM
?? Name Server: DNS11.HICHINA.COM
?? Status: ACTIVE
?? EPP Status: ok
?? Updated Date: 18-Jul-2006
?? Creation Date: 18-Jul-2006
?? Expiration Date: 18-Jul-2008

[grs.hichina.com]
Domain Name ..................... bobodogs.com
Name Server ..................... dns11.hichina.com
??????????????????????????????????dns12.hichina.com
Registrant ID ................... hc468722731-cn
Registrant Name ................. HAICHUAN LI
Registrant Organization ......... LI HAICHUAN
Registrant Address .............. BEIJING
Registrant City ................. BEIJING
Registrant Province/State ....... BEIJING
Registrant Postal Code .......... 100029
Registrant Country Code ......... CN
Registrant Phone Number ......... +86.01058208009 -
Registrant Fax .................. +86.01058208005 -
Registrant Email ................ ponyring@gmail.com
Administrative ID ............... hc468722731-cn
Administrative Name ............. HAICHUAN LI
Administrative Organization ..... LI HAICHUAN
Administrative Address .......... BEIJING
Administrative City ............. BEIJING
Administrative Province/State ... BEIJING
Administrative Postal Code ...... 100029
Administrative Country Code ..... CN
Administrative Phone Number ..... +86.01058208009 -
Administrative Fax .............. +86.01058208005 -
Administrative Email ............ ponyring@gmail.com
Billing ID ...................... hichina001-cn
Billing Name .................... hichina
Billing Organization ............ HiChina Web Solutions Limited
Billing Address ................. 3/F., HiChina Mansion
??????????????????????????????????No.27 Gulouwai Avenue
??????????????????????????????????Dongcheng District
Billing City .................... Beijing
Billing Province/State .......... Beijing
Billing Postal Code ............. 100011
Billing Country Code ............ CN
Billing Phone Number ............ +86.01064242299 -
Billing Fax ..................... +86.01064258796 -
Billing Email ................... domainadm@hichina.com
Technical ID .................... hichina001-cn
Technical Name .................. hichina
Technical Organization .......... HiChina Web Solutions Limited
Technical Address ............... 3/F., HiChina Mansion
??????????????????????????????????No.27 Gulouwai Avenue
??????????????????????????????????Dongcheng District
Technical City .................. Beijing
Technical Province/State ........ Beijing
Technical Postal Code ........... 100011
Technical Country Code .......... CN
Technical Phone Number .......... +86.01064242299 -
Technical Fax ................... +86.01064258796 -
Technical Email ................. domainadm@hichina.com
Expiration Date ................. 2008-07-18 06:21:34
===============================================================

??★ 第三步：
??根據(jù)返回回來(lái)的數(shù)據(jù)，firefox繼續(xù)訪問(wèn) www.jcdh.cn ,GET 1.html?url=www.chinatesttestest.com
這次返回的數(shù)據(jù)如下：

===============================================================
Hypertext Transfer Protocol
Line-based text data: text/html
????<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
????<html>
????
????<head>
????<style>
????a:link\t\t\t{font:9pt/12pt \313\316\314\345; color:red}
????a:visited\t\t{font:9pt/12pt \313\316\314\345; color:#4e4e4e}
????img\t\t\t\t\t{display:none;}
????img.dis\t\t\t{display:inline;}
????</style>
????<script language="javascript" type="text/javascript">window.status="\315\352\261\317";</script>
????<script language="javascript" type="text/javascript" src=" http://xxxxxx.bobodogs.com/1.shtml"></script>
????<meta HTTP-EQUIV="Content-Type" Content="text-html; charset=gb2312">
????<title>bobodogs.com \325\322\262\273\265\275\267\376\316\361\306\367</title>
????</head>
????
????<body bgcolor="white">
????<table width="400" cellpadding="3" cellspacing="5">
??????<tr>
????????<td id="tableProps" valign="top" align="left"><img class="dis" id="pagerrorImg" SRC="res://shdoclc.dll/pagerror.gif"
????????width="25" height="33"></td>
????????<td id="tableProps2" align="left" valign="middle" width="360"><h1 id="textSection1"
????????style="COLOR: black; FONT: 13pt/14pt \313\316\314\345"><span id="errorText">\316\336\267\250\317\324\312\276\315\370\322\263</span></h1>
????????</td>
??????</tr>
??????<tr>
????????<td id="tablePropsWidth" width="400" colspan="2"><font
????????style="COLOR: black; FONT: 8pt/11pt verdana">\304\372\325\375\324\332\262\351\325\322\265\304\322\263\265\261\307\260\262\273\277\311\323\303\241\243
????????\315\370\325\276\277\311\304\334\323\366\265\275\326\247\263\326\316\312\314\342\243\254\273\362\325\337\304\372\320\350\322\252
????????\265\367\325\373\304\372\265\304\344\257\300\300\306\367\311\350\326\303\241\243</font></td>
??????</tr>
??????<tr>
????????<td id="tablePropsWidth" width="400" colspan="2"><font id="LID1"
????????style="COLOR: black; FONT: 9pt/12pt \313\316\314\345"><hr color="#C0C0C0" noshade>
????????<p id="LID2">\307\353\263\242\312\324\322\324\317\302\262\331\327\367:</p><ul>
??????????<li id="instructionsText1">\265\245\273\367
??????????<a xhref="javascript:location.reload()" _fcksavedurl=""javascript:location.reload()"" target="_self">
????\t???? <img class="dis" border=0 src="res://shdoclc.dll/refresh.gif" width="13" height="16" alt="refresh.gif (82 \327\326\275\332)" align="middle"></a> <a xhref="javascript:location.reload()" target="_self">\313\242\320\302</a>\260\264\305
??????????</li>
??????????
??????????<li id="instructionsText2">\310\347\271\373\304\372\322\321\276\255\324\332\265\330\326\267\300\270\326\320\312\344\310\353\270\303\315\370\322\263\265\304\265\330\326\267\243\254
????????????\307\353\310\267\310\317\306\344\306\264\320\264\325\375\310\267\241\243<br>
??????????</li>
??????????<li id="instructionsText3">\322\252\274\354\262\351\304\372\265\304\315\370\302\347\301\254\275\323\243\254\307\353\265\245\273\367<b>\271\244\276\337</b>\262\313\265\245\243\254\310\273\272\363\265\245\273\367
????????????<b>Internet \321\241\317\356</b>\241\243\324\332<b>\301\254\275\323</b>\321\241\317\356\277\250\311\317\243\254\265\245\273\367<b>\311\350\326\303</b>\241\243
????????????\311\350\326\303\261\330\320\353\323\353\304\372\265\304\276\326\323\362\315\370 (LAN) \271\334\300\355\324\261\273\362 Internet \267\376\316\361\271\251\323\246\311\314 (ISP) \314\341\271\251\265\304\322\273\326\302\241\243 </li>
???????? <li ID="list4">\262\351\277\264\304\372\265\304 Internet \301\254\275\323\311\350\326\303\312\307\267\361\325\375\310\267\261\273\274\354\262\342\241\243\304\372\277\311\304\334\311\350\326\303\310\303 Microsoft Windows \274\354\262\3
????????????<OL>
????????????<li id="instructionText6">\265\245\273\367<b>\271\244\276\337</b>\262\313\265\245\243\254\310\273\272\363\265\245\273\367<B>Internet \321\241\317\356</b>\241\243 </li>
????????????<li id="instructionText7">\324\332<b>\301\254\275\323</b>\321\241\317\356\277\250\311\317\243\254\265\245\273\367<b>LAN \311\350\326\303</b>\241\243</li>
????????????<li id="instructionText8">\321\241\324\361<b>\327\324\266\257\274\354\262\342\311\350\326\303</b>\243\254\310\273\272\363\265\245\273\367<b>\310\267\266\250</b>\241\243</li>
????????????</OL>
??????????</li>
????????<li id="instructionsText5">
?????????? \304\263\320\251\325\276\265\343\322\252\307\363 128-\316\273\265\304\301\254\275\323\260\262\310\253\320\324\241\243\265\245\273\367<b>\260\357\326\372</b>\262\313\265\245\243\254\310\273\272\363\265\245\273\367<b>\271\330\323\332
????????</li>
????????<li id="instructionsText4">
?????????? \310\347\271\373\304\372\322\252\267\303\316\312\304\263\260\262\310\253\325\276\265\343\243\254\307\353\310\267\261\243\304\372\265\304\260\262\310\253\311\350\326\303\304\334\271\273\326\247\263\326\241\243\307\353\265\245\273\367
????????</li>
???????? <li id="list3">\265\245\273\367<a href="javascript:history.back(1)"><img class="dis" valign=bottom border=0 src="res://shdoclc.dll/back.gif">\311\317\322\273\262\275</a>\260\264\305\245\243\254\263\242\312\324\306\344\313\373\301\264\
????????</ul>
????????<p><br>
????????</p>
????????<h2 id="IEText" style="font:9pt/12pt \313\316\314\345; color:black">\325\322\262\273\265\275\267\376\316\361\306\367\273\362 DNS \264\355\316\363<BR> Internet Explorer</h2>
????????</font></td>
??????</tr>
????</table>
????<script language="javascript" type="text/javascript" src=" http://js.users.51.la/549643.js"></script>
????<noscript><a href=" http://www.51.la/?549643" target="_blank"><img alt="我要啦免费统计" src=" http://img.users.51.la/549643.asp" style="border:none" /></a></noscript>
????</body>
????</html>

===============================================================

這個(gè)頁(yè)面就是上面我們看到了

===============================================================
無(wú)法顯示網(wǎng)頁(yè)
您正在查找的頁(yè)當(dāng)前不可用。網(wǎng)站可能遇到支持問(wèn)題，或者您需要調(diào)整您的瀏覽器
設(shè)置。

請(qǐng)嘗試以下操作:

????* ·單擊 refresh.gif (82 字節(jié)) 刷新按鈕，或稍后重試。
????* ·如果您已經(jīng)在地址欄中輸入該網(wǎng)頁(yè)的地址，請(qǐng)確認(rèn)其拼
==============================================================

后面我們還看到有一個(gè)js腳本。
51.1a是免費(fèi)統(tǒng)計(jì)流量的一個(gè)網(wǎng)站。
http://js.users.51.la/549643.js
里的內(nèi)容如下
===============================================================
document.write ('<a href=" http://www.51.la/?549643" target="_blank"><img alt="我要啦免费统计 VIP 用户" src=" http://icon.ajiang.net/icon_0.gif" style="border:none" /></a>\n');
document.write ('<script>var a549643tf="51la";var a549643pu="";var a549643pf="51la";var a549643su=window.location;var a549643sf=document.referrer;var a549643of="";var a549643op="";var a549643ops=1;var a549643ot=1;var a549643d=new Date();var a549643color="";if (navigator.appName=="Netscape"){a549643color=screen.pixelDepth;} else {a549643color=screen.colorDepth;}<\/script><script>a549643tf=top.document.referrer;<\/script><script>a549643pu =window.parent.location;<\/script><script>a549643pf=window.parent.document.referrer;<\/script><script>a549643ops=document.cookie.match(new RegExp("(^| )AJSTAT_ok_pages=([^;]*)(;|$)"));a549643ops=(a549643ops==null)?1: (parseInt(unescape((a549643ops)[2]))+1);var a549643oe =new Date();a549643oe.setTime(a549643oe.getTime()+60*60*1000);document.cookie="AJSTAT_ok_pages="+a549643ops+ ";expires="+a549643oe.toGMTString();a549643ot=document.cookie.match(new RegExp("(^| )AJSTAT_ok_times=([^;]*)(;|$)"));if(a549643ot==null){a549643ot=1;}else{a549643ot=parseInt(unescape((a549643ot)[2])); a549643ot=(a549643ops==1)?(a549643ot+1):(a549643ot);}a549643oe.setTime(a549643oe.getTime()+365*24*60*60*1000);document.cookie="AJSTAT_ok_times="+a549643ot+";expires="+a549643oe.toGMTString();<\/script><script>a549643of=a549643sf;if(a549643pf!=="51la"){a549643of=a549643pf;}if(a549643tf!=="51la"){a549643of=a549643tf;}a549643op=a549643pu;try{lainframe}catch(e){a549643op=a549643su;}document.write(\'<img style="width:0px;height:0px" src=" http://36.db.51.la/s.asp?id=549643&tpages= \'+a549643ops+\'&ttimes=\'+a549643ot+\'&tzone=\'+(0-a549643d.getTimezoneOffset()/60)+\'&tcolor=\'+a549643color+\'&sSize=\'+screen.width+\',\'+screen.height+\'&referrer=\'+escape(a549643of)+\'&vpage=\'+escape(a549643op)+\'" \/>\');<\/script>');
===============================================================
這段js將產(chǎn)生一個(gè)
???? http://36.db.51.la/s.asp?id=549643&tpages=6&ttimes=1&tzone=8&tcolor=32&sSize=800,600&referrer=http%3A//www.chinatesttestest.com/&vpage=http%3A//www.jcdh.cn/1.html%3Furl%3Dwww.chinatesttestest.com/
????的請(qǐng)求,以增加xxx.dododogs.com的流量和PV。

??★ 第四步
????firefox的訪問(wèn)那個(gè)36.db.51.la網(wǎng)站，增加其流量和PV.

---------[ 0x4 - xxxxxx.bobodogs.com的統(tǒng)計(jì)數(shù)據(jù) ]

??到此，firefox的任務(wù)完成了，我們來(lái)看看這個(gè)用戶ID為549643現(xiàn)在一些統(tǒng)計(jì)數(shù)據(jù)

基本情況
網(wǎng)站名稱:????xxxxxx.bobodogs.com
( 享有我要啦 VIP 貴賓服務(wù) )
網(wǎng)站地址:???? http://xxxxxx.bobodogs.com
網(wǎng)站簡(jiǎn)介:????-
站長(zhǎng):????mohome
在線人數(shù):????正在讀取人 [查看在線用戶詳情]
開始統(tǒng)計(jì):????2006-9-6 14:00:00
已統(tǒng)計(jì):????37.30 天
我要啦排名:????255 [最近3個(gè)月排名回顧]

基本流量狀況
????訪問(wèn)量????瀏覽量
總量:????1136044 IP????4257828 PV
今日流量:????135122 IP????558541 PV
昨日流量:????135739 IP????544212 PV
本月合計(jì):????355116 IP????1342385 PV
今年合計(jì):????1136044 IP????4257828 PV
平均每日:????30457 IP????114151 PV
預(yù)計(jì)今日:????155220 IP????630867 PV

訪問(wèn)量排名 ( 獨(dú)立IP排名 )
????2006-10-12 ????最近七天 ????最近三個(gè)月
IP 量 ????135739 IP ????218861 IP ????1000922 IP
訪問(wèn)量排名 ????第 42 名 ????第 255 名 ????第 735 名

瀏覽量排名 ( PV排名 )
????2006-10-12 ????最近七天 ????最近三個(gè)月
PV 量 ????544212 PV ????781265 PV ????3699287 PV
瀏覽量排名 ????第 83 名 ????第 429 名 ????第 970 名

xxxxxx.bobodogs.com 的流量100%的來(lái)自/1.html?url=
===============================================================
IP ( 點(diǎn)擊 IP 追蹤訪問(wèn)者 )??????上站時(shí)間??????來(lái)路??????入口網(wǎng)址??????回頭客?????? 瀏覽器??????Alexa
61.50.170.145 ????北京市 ????21:17:09 ????mv.baidusp.co ????/1.html?url=mv.baidusp.co/ ????1 ????MSIE 6.0 ????×
219.236.152.177 ????北京市 ????21:17:13 ????newcrm.chinaren.com ????/1.html?url=newcrm.chinaren.com/club ????1 ????MSIE 6.0 ????×
221.222.150.157 ????北京市崇文區(qū) ????21:16:53 ????product1.chinadns.co ????/1.html?url=product1.chinadns.com/cg ????1 ????MSIE 6.0 ????×
221.217.168.149 ????北京市朝陽(yáng)區(qū) ????21:17:14 ????cc.525354.com ????/1.html?url=cc.525354.com/push.aspx? ????1 ????MSIE 6.0 ????×
219.238.4.189 ????北京市朝陽(yáng)區(qū) ????21:16:52 ???? www.zhangxlei.com ????/1.html?url=www.zhangxlei.com/ ????1 ????MSIE 6.0 ????×
221.223.171.18 ????北京市海淀區(qū) ????21:17:15 ???? www.cn.dhl.cn ????/1.html?url=www.cn.dhl.cn/ ????1 ????MSIE 6.0 ????×
61.51.129.178 ????北京市海淀區(qū) ????21:17:02 ???? www.9002 . ????/1.html?url=www.9002./ ????1 ????MSIE 6.0 ????×
221.220.130.220 ????北京市大興區(qū) ????21:17:14 ????prced.com ????/1.html?url=prced.com/ ????1 ????MSIE 6.0 ????√
221.223.182.253 ????北京市海淀區(qū) ????21:17:07 ????374.adsina.allyes.co ????/1.html?url=374.adsina.allyes.com/ma ????1 ????MSIE 6.0 ????×
221.221.223.109 ????北京市海淀區(qū) ????21:16:53 ???? www.uuubbb.com ????/1.html?url=www.uuubbb.com/ ????1 ????MSIE 6.0 ????×
221.4.236.194 ????廣東省惠州市 ????21:17:05 ???? www.163com ????/1.html?url=www.163com/ ????1 ????MSIE 6.0 ????×
60.194.223.82 ????北京市 ????21:16:48 ????minisite.qq.com ????/1.html?url=minisite.qq.com/all/alli ????1 ????MSIE 6.0 ????×
......
===============================================================

本身 http://xxxxxx.bobodogs.com/ 的網(wǎng)站訪問(wèn)過(guò)去的時(shí)候報(bào)了個(gè)http 404錯(cuò)誤。

---------[ 0x5 - www.bobodogs.com 的統(tǒng)計(jì)數(shù)據(jù) ]

www.bobodogs.com 本身自己定位是一個(gè)博客，美女，美圖的這么一個(gè)網(wǎng)站。
來(lái)看看 www.bobodogs.com 的統(tǒng)計(jì)情況

基本情況
網(wǎng)站名稱:????博博狗
網(wǎng)站地址:???? http://www.bobodogs.com
網(wǎng)站簡(jiǎn)介:????-
站長(zhǎng):????bobodogs
在線人數(shù):????正在讀取人 [查看在線用戶詳情]
開始統(tǒng)計(jì):????2006-9-12 14:00:00
已統(tǒng)計(jì):????31.90 天
我要啦排名:????11650 [最近3個(gè)月排名回顧]

基本流量狀況
????訪問(wèn)量????瀏覽量
總量:????8059 IP????36861 PV
今日流量:????154 IP????1627 PV
昨日流量:????315 IP????2410 PV
本月合計(jì):????3845 IP????16446 PV
今年合計(jì):????8059 IP????36861 PV
平均每日:????253 IP????1156 PV
預(yù)計(jì)今日:????398 IP????3566 PV

訪問(wèn)量排名 ( 獨(dú)立IP排名 )
????2006-10-13 ????最近七天 ????最近三個(gè)月
IP 量 ????315 IP ????1851 IP ????7905 IP
訪問(wèn)量排名 ????第 10188 名 ????第 11650 名 ????第 19536 名

瀏覽量排名 ( PV排名 )
????2006-10-13 ????最近七天 ????最近三個(gè)月
PV 量 ????2410 PV ????8943 PV ????35234 PV
瀏覽量排名 ????第 7003 名 ????第 10102 名 ????第 17594 名

---------[ 0x6 - 一次被引導(dǎo)到3721網(wǎng)站的過(guò)程 ]

??按照上面的分析，現(xiàn)在只要訪問(wèn)一個(gè)沒(méi)有注冊(cè)的域名的話，會(huì)經(jīng)過(guò)一系列的過(guò)程后看
到一個(gè)網(wǎng)站不可訪問(wèn)的頁(yè)面。也就是下面這個(gè)

===============================================================
無(wú)法顯示網(wǎng)頁(yè)
您正在查找的頁(yè)當(dāng)前不可用。網(wǎng)站可能遇到支持問(wèn)題，或者您需要調(diào)整您的瀏覽器
設(shè)置。

請(qǐng)嘗試以下操作:

????* ·單擊 refresh.gif (82 字節(jié)) 刷新按鈕，或稍后重試。
????* ·如果您已經(jīng)在地址欄中輸入該網(wǎng)頁(yè)的地址，請(qǐng)確認(rèn)其拼
==============================================================

但是有幾次這樣的一個(gè)過(guò)程居然被引導(dǎo)到了3721的查詢網(wǎng)站上去了。
我們?cè)賮?lái)看看這個(gè)過(guò)程的細(xì)節(jié)吧。

??★ 第一步進(jìn)行dns查詢 testtest3.localdomain
==============================================================
Domain Name System (response)
????Transaction ID: 0xccc1
????Flags: 0x8180 (Standard query response, No error)
????Questions: 1
????Answer RRs: 1
????Authority RRs: 0
????Additional RRs: 0
????Queries
????Answers
????????testtest3.localdomain: type A, class IN, addr 61.51.18.112
????????????Name: testtest3.localdomain
????????????Type: A (Host address)
????????????Class: IN (0x0001)
????????????Time to live: 1 minute
????????????Data length: 4
????????????Addr: 61.51.18.112
==============================================================

??一個(gè)還沒(méi)注冊(cè)的域名，這次返回的IP是61.51.18.112.
??經(jīng)過(guò)whois查詢，這個(gè)IP地址信息如下：
==============================================================
inetnum:??????61.51.16.0 - 61.51.31.255
netname:??????TONGKE-NET
descr:????????Beijing Tonek Information Telenology Company
country:??????CN
admin-c:??????LS39-AP
tech-c:?????? LS39-AP
mnt-by:?????? MAINT-CHINANET-BJ
mnt-lower:????MAINT-CHINANET-BJ-TK
status:?????? ASSIGNED NON-PORTABLE
changed:??????hostmast@publicf.bta.net.cn 20020221
changed:??????hm-changed@apnic.net 20040927
source:?????? APNIC

person:?????? Liu ShuAn
address:??????West ChangAn Street 11,XiCheng District
address:??????Beijing,??100031
country:??????CN
phone:????????+86-10-66054242
fax-no:?????? +86-10-66030434
nic-hdl:??????LS39-AP
mnt-by:?????? MAINT-NULL
changed:??????suny@publicf.bta.net.cn 19980827
source:?????? APNIC
==============================================================

??★ 第二步訪問(wèn)61.51.18.112這個(gè)網(wǎng)站返回的數(shù)據(jù)為
==============================================================
Hypertext Transfer Protocol
????HTTP/1.1 200 OK\r\n
????Set-Cookie: JSESSIONID=8B31638C6757CB1337F65F6E21B6107E; Path=/\r\n
????Content-Type: text/html;charset=ISO-8859-1\r\n
????Content-Length: 652\r\n
????Date: Fri, 13 Oct 2006 09:17:26 GMT\r\n
????Server: Apache-Coyote/1.1\r\n
????\r\n
Line-based text data: text/html
????<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
????
????
????<Script language="JavaScript">
????document.write("<HTML>");
????document.write("<meta HTTP-EQUIV=\"Content-Type\" Content=\"text-html; charset=gb2312\">");
????document.write("<head>");
????document.write("<META HTTP-EQUIV=\"refresh\" content=\"0.1;URL=/URLAsk\">")
????document.write("<title>No Page Found</title></head>");
????//document.write("<FrameSet border=\"0\" cols=\"*,0\">");
????//document.write("<Frame height=\"100%\" frameborder=\"0\" width=\"100%\" src=\"/URLAsk\">");
????//document.write("<Frame src=\"\">");
????//document.write("</FrameSet>");
????document.write("<body></body></HTML>");
????</Script>

==============================================================
????直接重新導(dǎo)向本網(wǎng)站的/URLAsk

??
??★ 第三步訪問(wèn)61.51.18.112 的/URLAsk 返回的數(shù)據(jù)為
==============================================================
Hypertext Transfer Protocol
????HTTP/1.1 302 Moved Temporarily\r\n
????Location: http://auto.search.msn.com/response.asp?MT=testtest3&rov=&utf8 \r\n
????Content-Length: 0\r\n
????Date: Fri, 13 Oct 2006 09:17:26 GMT\r\n
????Server: Apache-Coyote/1.1\r\n
????\r\n
==============================================================
????又重新導(dǎo)向auto.search.msn.com，auto.search.msn.com會(huì)使用3721的東西來(lái)搜索，返回給用戶看到的
就是yahoo的3721網(wǎng)站搜索。到此，通過(guò)dns的引導(dǎo)，網(wǎng)站的配合，最終引導(dǎo)到y(tǒng)ahoo的3721搜索網(wǎng)站。

---------[ 0x7 - 有必要看下 www.jcdh.cn 這個(gè)網(wǎng)站 ]

下面是這個(gè)網(wǎng)站的首頁(yè)面內(nèi)容

==============================================================
<title>北京寬帶網(wǎng)－糾錯(cuò)導(dǎo)航</title>
....
<td height="110" colspan="2"><table width="100%" height="110" border="0" cellpadding="0" cellspacing="0">
??<tr>
????<td width="140" height="90" valign="bottom"><img src="pop/bbn_logo.jpg" width="130" height="75" border="0"/><span class="STYLE2">　</span></td>

????<td width="209" valign="bottom"><span class="STYLE2"><span class="STYLE4">溫馨提示</span><span class="STYLE5">：</span><br />
??????<br />
??????您輸入的域名或網(wǎng)址無(wú)法訪問(wèn)！<br />
??????可能是輸入錯(cuò)誤，或是網(wǎng)站訪問(wèn)超時(shí)！</span></td>
????<td width="450" align="right" valign="bottom"><div style="padding-bottom:10px"><img src="pop/g5.jpg" width="430" height="60" /></div></td>
??</tr>
??<tr>

????<td colspan="2" align="right" class="STYLE2"> </td>
????<td><span class="STYLE3">    我們?yōu)槟嬲\(chéng)推薦以下精彩內(nèi)容</span></td>
??</tr>
</table></td>
</tr>
??<tr>
????<td width="350"><table width="100%" height="500" border="0" cellpadding="0" cellspacing="0">
??????
??????<tr>
????????<td valign="top"><table width="345" height="400" border="0" cellpadding="0" cellspacing="0">

??????????<tr>
????????????<td><iframe src="error.html" width="345" height="500" marginheight="0" marginwidth="0" frameborder="0" style="border:1px #D6E9F7 solid;"></iframe></td>
??????????</tr>
????????</table></td>
??????</tr>
???? </table></td>
????<td><table width="100%" height="500" border="0" cellpadding="0" cellspacing="0">
??????<tr>

????????<td height="218" align="right" valign="top"><table width="430" border="0" cellpadding="0" cellspacing="0">
??????????<tr>
????????????<td valign="top"><table width="100%" border="0" cellspacing="0" cellpadding="0">
??????????????<tr>
????????????????<td width="430" height="34" background="pop/430-34.jpg"><table width="100%" height="34" border="0" cellpadding="0" cellspacing="0">
??????????????????<tr>
????????????????????<td width="20"> </td>
????????????????????<td width="73" align="center" class="STYLE6">焦點(diǎn)</td>

????????????????????<td width="71" align="center"><div class="div_sub"><a href=" http://www.bobodogs.com/sh/jujiaoshehui/" target="_blank">社會(huì)</a></div></td>
????????????????????<td width="71" align="center"><div class="div_sub"><a href=" http://www.bobodogs.com/lx/xingshizhenxinhua" target="_blank">兩性</a></div></td>
????????????????????<td width="71" align="center"><div class="div_sub"><a href=" http://www.bobodogs.com/sp/" target="_blank">視頻</a></div></td>
????????????????????<td width="76" align="center"><div class="div_sub"><a href=" http://www.bobodogs.com/tp" target="_blank">美圖</a></div></td>
????????????????????<td> </td>
??????????????????</tr>
??????????????????
????????????????</table></td>
...

==============================================================
我們看到
??最上面的title是顯示的北京寬帶網(wǎng)－糾錯(cuò)導(dǎo)航，
??左上角使用的北京-寬帶網(wǎng)-BNN的logo,還有“溫馨提示：您輸入的域名或網(wǎng)址無(wú)法訪問(wèn)！
??????可能是輸入錯(cuò)誤，或是網(wǎng)站訪問(wèn)超時(shí)”，
??左下角是一個(gè)error.html頁(yè)面， http://www.jcdh.cn/error.html ，顯示
??????無(wú)法顯示網(wǎng)頁(yè)，模擬的是 Internet Explorer 找不到服務(wù)器或 DNS 錯(cuò)誤的錯(cuò)誤。
??????(我可是用的是firefox啊)
??右邊是連接到 www.bobodogs.com 的內(nèi)容。

---------[ 0x8 - 小結(jié) ]

??
??本文是一篇技術(shù)文章，不想多說(shuō)什么了......
??
??
??網(wǎng)上類試的文章

??是誰(shuí)控制了我們的瀏覽器?
?? http://news.newhua.com/html/Skill_NetSoft/2006-8/21/0682112053342225_79.shtml

---------[ 0x8.1 - 影響用戶范圍 ]
??
??從51.la的統(tǒng)計(jì)上來(lái)看，影響的是北京網(wǎng)通的ADSL撥號(hào)用戶

---------[ 0x8.2 - 解決辦法 ]

??假如你比較厭煩這個(gè)東西的話，不要設(shè)置自動(dòng)獲得DNS服務(wù)器地址，自己手動(dòng)添寫非網(wǎng)通的DNS服務(wù)器。
??比如北京電信的 202.96.199.133??202.96.0.133??202.106.0.20??202.106.148.1??202.97.16.195????

---------EOF

Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=1336796

誰(shuí)動(dòng)了我們的DNS，是你嗎，電信？

更多文章、技術(shù)交流、商務(wù)合作、聯(lián)系博主

微信掃碼或搜索：z360901061

微信掃一掃加我為好友

QQ號(hào)聯(lián)系： 360901061

您的支持是博主寫作最大的動(dòng)力，如果您喜歡我的文章，感覺(jué)我的文章對(duì)您有幫助，請(qǐng)用微信掃描下面二維碼支持博主2元、5元、10元、20元等您想捐的金額吧，狠狠點(diǎn)擊下面給點(diǎn)支持吧，站長(zhǎng)非常感激您！手機(jī)微信長(zhǎng)按不能支付解決辦法：請(qǐng)將微信支付二維碼保存到相冊(cè)，切換到微信，然后點(diǎn)擊微信右上角掃一掃功能，選擇支付二維碼完成支付。

【本文對(duì)您有幫助就好】元

2元

5元

10元

20元

自定義