IP with 4 digits?

[HitProf]

Got an email originating from this type of IP number:

1.1.1234.22

How is that possible? Did I miss something?

BTW the content of the enail is OK, nothing to do with spam or virusses.

Thanks.

[JonR28]

IPV6? Its starting to get use isn't it? Someone told me in 10 years there won't be 32bit IPs anymore.

Although that IP you have there looks entirely fake.

[digitalv]

IPV6 addresses look more like 3ffe:400:107:1 than "longer" IP addresses. 5 years ago they told us IPv4 would be gone in 5 years.

I doubt we'll ever see it.

[john_k]

Where did you get the IP address from? The email header information can be faked, so the sender could have put in whatever they wanted.

When I ran it through the decimal IP converter at dnsstuff.com, the results displayed were

Country: [IANA Reserved] 
IP 1.5.210.22 is decimal 17158678. 

When I did an IP whois at arin.net, it returns "No match found for 1.1.1234.22."

So any way you slice it, it is an invalid IP address.

[HitProf]

Some more info: of course it's not the real IP address, (the first 1 is acually a 5), but the format is what I got.

Ripe: "%ERROR:101: no entries found".
Arin: No match found for ERROR:105.5.2653.19.
Apnic: %ERROR:101: no entries found

Normally I don't check email IP's but this was a question related to a site and I wanted to check if they had seen a specific page or not. When the IP didn't match any logged entries I took a closer look and detected the strange format. Again: with the email itself is nothiing wrong, it's a genuine question and I have the company name, address and phone number. (But this is not something I can ask them about).

Could it be some sort of proxy? For what purpose? Some bug?

[taivu]

You got me curious... what part of the headers was this IP in? Could you please paste the (obfuscated) headers in here or sticky me...?

That IP sure is invalid and should not appear in any of the "Reseaved" headers... no, let me correct that... not in the last one (listed first) anyway, since the MTA is supposed to be checking that if it's anyway near correctly configured. As for HELO/EHLO, anything is possible ;)

[HitProf]

sure:

The strage IP is the first chonologically (so it's on their side, not mine).

Received: from [333.333.333.22] (helo=mailrelay1.bigisp.net) by myhost.com with esmtp (Exim 4.34) id IDNR for [e-mail]; Day, date+time
Received: from [123.123.1.12] (helo=someprog.theirdomainname.com) by mailrelay1.bigisp.net with smtp (Exim 3.36 #1) id IDNR for [e-mail]; Day, time+date
Received: by SOMEPROG with Internet Mail Service (1.1.1234.12) id <NR>; Day, date+time
Message-ID: <[e-mail]>
From: "Name" <[e-mail]>
To: "'[e-mail]'" <[e-mail]>

Is this what you wanted to know?

I'm still curious :)

[py9jmas]

Received: by SOMEPROG with Internet Mail Service (1.1.1234.12) id <NR>; Day, date+time

That's the software version number, not an IP.

Re IPv6 - It's been in commercial use in Japan for years. If every Chinese university had the IP space they require (in the numbers US and European Unis have) there would be no IPv4 addresses left.

[hostbreak]

hey you gys really made me confused.. hows that possible to get IP in such sequence? hmm i think its must be a seemless IP... right?

[HitProf]

*blush*

And thanks!