I try to avoid "this" style comments, but I genuinely don't know how else to respond to this one. It was hilarious. I literally (by which I actually mean "literally") laughed out loud.
Yeah, IPv4 addresses use four bytes. Those four bytes are represented as four decimal numbers, separated by dots. And a byte can only represent the decimal values 0–255.
I often assume this kind of thing is part of an effort to filter for idiots
If you know that's an invalid IP address, you're probably less likely to fall for the scam after the scammer has put the setup work in. So if they filter you out before a scammer has to spend any actual effort on you, that means more time they can spend scamming people who might be more likely to fall for it
That's why these things often have egregious spelling errors and other seemingly obvious red flags
It's possible in general, but I don't think that's what's going on specifically here; not many people read IP addresses in such detail to notice such things at first glance.
The point schnurrito was making is that even if you know what an IP address is and what are valid or invalid IP addresses, a lot of people won't read the IP address. They'll just see numbers and skim over them. Even if you're keeping eyes peeled for scams, most people don't have their IP address memorised off the top of their heads so they wouldn't be looking to check if the IP address looks right or not.
Then I don't think that would be the most effective way because most people aren't paying that much attention, independently of knowledge. What would tip me off to it being a scam would be other parts of the email.
They put in a lot of flags like that, of varying obviousness, to filter out as many people as possible who would be savvy enough to not fall for the scam overall. It’s not just one clue, it never is.
It's good to see someone in this thread who knows what an IPv5 address looks like:
IPv5 addresses consist of four hextets a 16bit each. For the visual
representation, those grouping are used. The hextets might be
written in decimal, separated by dot '.' characters, or as
hexadecimal numbers, separated by colon ':'.
It's long past time to start replacing our IPv4.1 deployments!
In addition to what others have already posted, I suspect that this might be an attempt to evade spam/phishing filters that are looking for an IP address with a specific regular expression. Having a fake IP address that doesn’t match the traditional ^((25\[0-5]|(2\[0-4]|1\d|\[1-9]|)\d)\\.?\b){4}$ format might let this message slip through.
Alternatively, the scammer is saving themselves some time; more educated, well-versed people will see the ip and not bother calling in. Less savvy people who don't know the IP address is bogus are likely easier to scam if they call the phone number or reply to the mail.
This is exactly right, I'm pretty sure. Scam emails are poorly written and have tells for anyone paying attention on purpose. It's a feature, not an error.
Scammers don't want to waste time on someone who will never believe that the government takes Walmart gift cards.
That's exactly the reaction they want. That aspect of the scam helps filter out people who might be smart enough to properly retaliate if they were to get scammed out of 20k or whatever.
I'm still angry even 15 years later after a teacher lowered my grade just because I checked "USB" as capable technologies for video transmission. There are literally USB monitors.
Granted, back then it really wasn't popular and bandwidth was shit, but it was capable of it.
USB to VGA dongles were definitely a thing over 15 years ago. USB 2.0 could manage it fineish. Maybe not at high resolutions and refresh rates, but it could handle a monitor just fine.
Yes, each number can land somewhere between 0-255, but there are some default reservations on specific IP ranges.
For instance, 0 is typically used as an identifier for the subnet, not as an actual device IP. For instance, a DHCP server may tell a device “your IP address is 192.168.1.168. The subnet range is 192.168.1.0/24 (meaning the mask is 255.255.255.0). But the 0 won’t (or shouldn’t) get assigned to a specific device.
255 is another special address, as it is used for broadcast messages. A packet sent to 255 gets sent to everything in that subnet. So for instance, if I wanted to broadcast a message to everything on the 192.168.1.0/24 range, I would send it to 192.168.1.255.
In regards to reserved IP ranges, there are a few standard private IP ranges:
192.168.0.0/16 one of the more common. (Subnet mask of 255.255.0.0). This basically means that (if everything is configured properly) your WAN IP won’t ever be something inside of that same range, as the router would very quickly throw up its hands in defeat. Like if your WAN IP from your ISP was 192.168.1.50, and you also had a device on your network with that same IP address, the router wouldn’t know which one (WAN IP or LAN device) to send traffic to.
The second private IP range is 172.16.0.0/20 (subnet mask of 255.240.0.0) meaning the second number can range from 0-31, and the last two octets can range from 0-255.
The last common private IP range is 10.0.0.0/8, (subnet mask of 255.0.0.0) so the last three octets can range from 0-255. You tend to see these more in corporate settings, as it allows for a truly astronomical number of devices to be connected.
Basically, all of this means that if you see an address in the 192.168.x.x, 172.0-32.x.x, or 10.x.x.x range, you know it’s a private IP address, not a WAN IP.
Long story short? The subnet mask determines which numbers can change. A mask of 255 means there is no change. A mask of 0 means any number can change. So for instance, a range of 192.168.1.0 with a mask of 255.255.255.0 will only find other devices in the 192.168.1.x range. Because the last octet is the only one that isn’t 255.
And writing the range as 192.168.1.0/24 is simply a shorter way to accomplish the same thing. Each group of numbers is an octet made of 8 bits. So masking the first 8 bits (255.0.0.0) is /8. Masking the first 16 bits (255.255.0.0) is /16, and masking the first 24 bits (255.255.255.0) is /24. So 192.168.1.0/16 would be able to find anything in the 192.168.x.x range.
If you want to get really deep in it, you can manually calculate subnet masks. Remember that computers work in binary, and the octets are each a group of 8 bits. For example, the IP address 192.168.42.67 could also be written as 00000011.00010101.01010100.11000010 but that’s a nightmare for humans to remember so we use base 10 by default.
The subnet mask tells the computer which bits may be different. So a subnet mask of 255.255.255.0 looks like this: 11111111.11111111.11111111.00000000. So the computer will only scan for neighbors on any bits that are 0’s (unmasked). So in this case, if the range is 192.168.42.0/24, it will assume that the first three octets (192, 168, and 42, respectively) are going to match. So it will only scan for differences in the last octet.
Neither 867:5309:: nor 867::5309 appears to be allocated. Do IPv6 blocks work like car license plates where you can pay more to get a vanity plate of your choice or do you just get what you get?
I was surprised to find that this doesn’t work at all.
For instance, 300 is considered a valid IP by e.g. Firefox, typing 300/ into Firefox will navigate to http://0.0.1.44/.
I was expecting this to be interpreted as just Σ 256ⁿ × dₙ mod 256⁴. But it isn’t, Firefox won’t accept this (it performs a web search instead). Neither will curl (which tries to look up a domain by this name).
74 Comments
First_Thunder@lemmy.zip · 173 pts · 156d
Oh yeah, that’s the new hexadecimal IPV8
slazer2au@lemmy.world · 70 pts · 156d
IPv5.
dracs@programming.dev · 30 pts · 156d
I think you mean IPV0x08
toynbee@piefed.social · 5 pts · 156d
I try to avoid "this" style comments, but I genuinely don't know how else to respond to this one. It was hilarious. I literally (by which I actually mean "literally") laughed out loud.
mergingapples@lemmy.world · 15 pts · 156d
Hello, I am apparently an idiot. What is wrong with that IP address that people can tell it's an immediate phishing scam?
Turious@leaf.dance · 42 pts · 156d
IP addresses can't have segment numbers going over 255.
Ephera@lemmy.ml · 14 pts · 156d
Yeah, IPv4 addresses use four bytes. Those four bytes are represented as four decimal numbers, separated by dots. And a byte can only represent the decimal values 0–255.
mergingapples@lemmy.world · 3 pts · 155d
Ahhhh. Thank you. Now the Ipv over 4 jokes make sense.
ghodawalaaman@programming.dev · 5 pts · 156d
wait what? I feel like I am left behind in the tech. I only know about ipv4 and ipv6 😭😭😭
tyler@programming.dev · 50 pts · 156d
They’re making a joke. The numbers in the IP are way too high for v4, but the format isn’t v6, so it’s a “new range” of v8.
vivalapivo@lemmy.today · 6 pts · 156d
Where's IPv7?
teddypolice@feddit.org · 9 pts · 156d
at 192.512.512.10.0/42.
Atherel@lemmy.dbzer0.com · 7 pts · 156d
In the drawer right next to IPv5
zr0@lemmy.dbzer0.com · 5 pts · 156d
IPv4 was easy to remember. IPv6 made it very hard. This implies that IPv8 has to be base64 encoded.
9point6@lemmy.world · 159 pts · 156d
I often assume this kind of thing is part of an effort to filter for idiots
If you know that's an invalid IP address, you're probably less likely to fall for the scam after the scammer has put the setup work in. So if they filter you out before a scammer has to spend any actual effort on you, that means more time they can spend scamming people who might be more likely to fall for it
That's why these things often have egregious spelling errors and other seemingly obvious red flags
zo0@programming.dev · 77 pts · 156d
Just because I know what a valid IP is doesn't mean I'm not an idiot 😎
toynbee@piefed.social · 16 pts · 156d
Let's see you write a regex for one, then we'll decide.
JasonDJ@lemmy.zip · 6 pts · 156d
Why would anyone want to do that when there are dozens on stackoverflow?
zitrone@europe.pub · 2 pts · 151d
lemme try
tbh i have seen the stackoverflow solutions so i kinda know what i needed to do
this is entirely typed out from brain tho
toynbee@piefed.social · 1 pts · 151d
I'm currently on my phone and I'm not going to try to figure out how to test regex on Graphene. Therefore I can only say: well done!
ulterno@programming.dev · 3 pts · 156d
That's not the probability they are looking for.
DScratch@sh.itjust.works · 49 pts · 156d
I do believe that is confirmed canon.
entwine@programming.dev · 2 pts · 155d
I remember reading about this many years ago as an explanation for why there were so many banner ads that looked like they were created in MS paint.
schnurrito@discuss.tchncs.de · 18 pts · 156d
It's possible in general, but I don't think that's what's going on specifically here; not many people read IP addresses in such detail to notice such things at first glance.
Cypher@aussie.zone · 11 pts · 156d
It’s exactly what is happening, they’re filtering out people who know what an IP address is and can contain so that they get fewer time wasters.
communism@lemmy.ml · 7 pts · 156d
The point schnurrito was making is that even if you know what an IP address is and what are valid or invalid IP addresses, a lot of people won't read the IP address. They'll just see numbers and skim over them. Even if you're keeping eyes peeled for scams, most people don't have their IP address memorised off the top of their heads so they wouldn't be looking to check if the IP address looks right or not.
Cypher@aussie.zone · 7 pts · 156d
And the point I’m making is that they’re doing it to filter out people who know and pay attention. Real simple stuff.
communism@lemmy.ml · -3 pts · 156d
Then I don't think that would be the most effective way because most people aren't paying that much attention, independently of knowledge. What would tip me off to it being a scam would be other parts of the email.
ApathyTree@lemmy.dbzer0.com · 1 pts · 156d
You, maybe, someone else, maybe not.
They put in a lot of flags like that, of varying obviousness, to filter out as many people as possible who would be savvy enough to not fall for the scam overall. It’s not just one clue, it never is.
teddypolice@feddit.org · 15 pts · 156d
Movies and TV shows actually do it this way to prevent actual machines getting group hugged.
Like in that one X-Files episode, where the Lone Gunmen hack into an invalid IP.
sniggleboots@europe.pub · 8 pts · 156d
It's also why there's usually bad spelling or grammar in those e-mails as well
SCmSTR@lemmy.blahaj.zone · 2 pts · 156d
I never thought of it like that before. I wonder how common this intent actually is...
the_crotch@sh.itjust.works · 102 pts · 156d
It's not often you see IPv5
cypherpunks@lemmy.ml · 36 pts · 156d
It's good to see someone in this thread who knows what an IPv5 address looks like:
It's long past time to start replacing our IPv4.1 deployments!
thr0w4w4y2@sh.itjust.works · 53 pts · 156d
In addition to what others have already posted, I suspect that this might be an attempt to evade spam/phishing filters that are looking for an IP address with a specific regular expression. Having a fake IP address that doesn’t match the traditional
^((25\[0-5]|(2\[0-4]|1\d|\[1-9]|)\d)\\.?\b){4}$format might let this message slip through.InFerNo@lemmy.ml · 7 pts · 156d
And it hooks tech illiterate people, avoiding people who know something's wrong. The perfect target.
Sv443@sh.itjust.works · 50 pts · 156d
This is just an IPv5, they're quite rare in the wild
SCmSTR@lemmy.blahaj.zone · 43 pts · 156d
Took me a second to figure out what was wrong with the email... I choked on a laugh when I saw the IP
What a bizarre, narrow window of knowledge that person must have
ThetaDecay@lemmy.world · 25 pts · 156d
Alternatively, the scammer is saving themselves some time; more educated, well-versed people will see the ip and not bother calling in. Less savvy people who don't know the IP address is bogus are likely easier to scam if they call the phone number or reply to the mail.
definitemaybe@lemmy.ca · 2 pts · 155d
This is exactly right, I'm pretty sure. Scam emails are poorly written and have tells for anyone paying attention on purpose. It's a feature, not an error.
Scammers don't want to waste time on someone who will never believe that the government takes Walmart gift cards.
forrgott@lemmy.zip · 2 pts · 155d
Dark patterns, aka reverse psychology, are rather fucked up by their very nature...
new_world_odor@lemmy.world · 18 pts · 155d
That's exactly the reaction they want. That aspect of the scam helps filter out people who might be smart enough to properly retaliate if they were to get scammed out of 20k or whatever.
ryannathans@aussie.zone · 40 pts · 156d
New address space unlocked
Zozano@aussie.zone · 32 pts · 156d
For the uninitiated, the joke is:
::: spoiler spoiler Each number should has a maximum value of 255. :::
imjustmsk@lemmy.world · 6 pts · 156d
The fact that I have a test in school today, and this is probable questiom in it, and this post reminded me of it, thanks I guess?
EDIT: wait, so each number should be maximum of 255? Why did I think it was just the last numbe :|
anyway thanks again for the unsolicited coincidental heads up
REDACTED@infosec.pub · 4 pts · 155d
I'm still angry even 15 years later after a teacher lowered my grade just because I checked "USB" as capable technologies for video transmission. There are literally USB monitors.
Granted, back then it really wasn't popular and bandwidth was shit, but it was capable of it.
scutiger@lemmy.world · 4 pts · 155d
USB to VGA dongles were definitely a thing over 15 years ago. USB 2.0 could manage it fineish. Maybe not at high resolutions and refresh rates, but it could handle a monitor just fine.
disobey2623@lemmy.dbzer0.com · 2 pts · 156d
Each number between the dots is made up of 8 bits, so each one is a maximum of 255.
imjustmsk@lemmy.world · 4 pts · 156d
Update, they didn't ask that questiom. For the exam XD
disobey2623@lemmy.dbzer0.com · 1 pts · 156d
Hope it went well!
imjustmsk@lemmy.world · 3 pts · 156d
It did, I mean it was a computer science test which was easy (I help the computer teachers to solve stuff in school lol)
mic_check_one_two@lemmy.dbzer0.com · 2 pts · 155d
Yes, each number can land somewhere between 0-255, but there are some default reservations on specific IP ranges.
For instance, 0 is typically used as an identifier for the subnet, not as an actual device IP. For instance, a DHCP server may tell a device “your IP address is 192.168.1.168. The subnet range is 192.168.1.0/24 (meaning the mask is 255.255.255.0). But the 0 won’t (or shouldn’t) get assigned to a specific device.
255 is another special address, as it is used for broadcast messages. A packet sent to 255 gets sent to everything in that subnet. So for instance, if I wanted to broadcast a message to everything on the 192.168.1.0/24 range, I would send it to 192.168.1.255.
In regards to reserved IP ranges, there are a few standard private IP ranges:
192.168.0.0/16 one of the more common. (Subnet mask of 255.255.0.0). This basically means that (if everything is configured properly) your WAN IP won’t ever be something inside of that same range, as the router would very quickly throw up its hands in defeat. Like if your WAN IP from your ISP was 192.168.1.50, and you also had a device on your network with that same IP address, the router wouldn’t know which one (WAN IP or LAN device) to send traffic to.
The second private IP range is 172.16.0.0/20 (subnet mask of 255.240.0.0) meaning the second number can range from 0-31, and the last two octets can range from 0-255.
The last common private IP range is 10.0.0.0/8, (subnet mask of 255.0.0.0) so the last three octets can range from 0-255. You tend to see these more in corporate settings, as it allows for a truly astronomical number of devices to be connected.
Basically, all of this means that if you see an address in the 192.168.x.x, 172.0-32.x.x, or 10.x.x.x range, you know it’s a private IP address, not a WAN IP.
imjustmsk@lemmy.world · 1 pts · 155d
The last time I was this confused reading something was when I was trying to under organic chemistry.
mic_check_one_two@lemmy.dbzer0.com · 1 pts · 155d
Long story short? The subnet mask determines which numbers can change. A mask of 255 means there is no change. A mask of 0 means any number can change. So for instance, a range of
192.168.1.0with a mask of255.255.255.0will only find other devices in the192.168.1.xrange. Because the last octet is the only one that isn’t 255.And writing the range as
192.168.1.0/24is simply a shorter way to accomplish the same thing. Each group of numbers is an octet made of 8 bits. So masking the first 8 bits (255.0.0.0) is /8. Masking the first 16 bits (255.255.0.0) is /16, and masking the first 24 bits (255.255.255.0) is /24. So192.168.1.0/16would be able to find anything in the192.168.x.xrange.If you want to get really deep in it, you can manually calculate subnet masks. Remember that computers work in binary, and the octets are each a group of 8 bits. For example, the IP address
192.168.42.67could also be written as00000011.00010101.01010100.11000010but that’s a nightmare for humans to remember so we use base 10 by default.The subnet mask tells the computer which bits may be different. So a subnet mask of 255.255.255.0 looks like this:
11111111.11111111.11111111.00000000. So the computer will only scan for neighbors on any bits that are 0’s (unmasked). So in this case, if the range is 192.168.42.0/24, it will assume that the first three octets (192, 168, and 42, respectively) are going to match. So it will only scan for differences in the last octet.imjustmsk@lemmy.world · 1 pts · 155d
Wait, that actually made sense? I kinda knew some of this but now it all commceted makes sense. thanks lol
Janx@piefed.social · 1 pts · 155d
*octet
saltnotsugar@lemmy.world · 24 pts · 156d
Jesus Christ, that’s Jason Bourne’s IP address!
entwine@programming.dev · 20 pts · 155d
That's called Web 3.0
mojofrododojo@lemmy.world · 2 pts · 155d
homey is being phished from internet 7.
slampisko@lemmy.world · 18 pts · 156d
Sorry, that's my IP. I was trying something
DragonTypeWyvern@midwest.social · 6 pts · 156d
(theft)
Bonsoir@lemmy.ca · 17 pts · 156d
Please, do not share the button. It's gross.
gergolippai@lemmy.world · 15 pts · 156d
no shit they don't recognize that IP :-D but hey, they also single handedly solved the IP4 address space crisis!
python@lemmy.world · 11 pts · 156d
Ok I admit I didn't get it at first because I expected the joke to be that the IP is 127.0.0.1 and didn't look closer at the digits
shawn@thagoat.org · 11 pts · 156d
86.75.30.9
davidgro@lemmy.world · 8 pts · 156d
That cancer support line should buy this one also
eah@programming.dev · 1 pts · 156d
Neither 867:5309:: nor 867::5309 appears to be allocated. Do IPv6 blocks work like car license plates where you can pay more to get a vanity plate of your choice or do you just get what you get?
Janx@piefed.social · 8 pts · 155d
I think I see why the login attempt was unsuccessful!
elucubra@sopuli.xyz · 5 pts · 155d
Spain has better food, better beaches, hotter women, better fiesta, better weather, better lifestyle, better IP's.
Deal with it.
AffineConnection@lemmy.world · 5 pts · 154d
They just wanted to make doubly sure that whoever they are phishing is an idiot before they proceed further.
schuelermine@leminal.space · 4 pts · 155d
I was surprised to find that this doesn’t work at all.
For instance,
300is considered a valid IP by e.g. Firefox, typing300/into Firefox will navigate tohttp://0.0.1.44/. I was expecting this to be interpreted as just Σ 256ⁿ × dₙ mod 256⁴. But it isn’t, Firefox won’t accept this (it performs a web search instead). Neither willcurl(which tries to look up a domain by this name).abbadon420@sh.itjust.works · 4 pts · 156d
Probably outer space
ttyybb@lemmy.world · 2 pts · 156d
Your first mistake is sharing this email with everyone here
diabetic_porcupine@lemmy.world · 1 pts · 155d
You guys still getting the “claim your blockfi settlement payout” emails?
webkitten@piefed.social · 1 pts · 156d