cross-posted from: https://lemmy.world/post/14131393
Recently discovered the following two addresses in my DNS-filter, 26.26.26.1 and 26.26.26.2. How can I confirm that these belong to? These are both public-ip addresses but seems to be owned by the US Military?
If I look at https://www.abuseipdb.com/check/26.26.26.2, it says it belongs to:
- ISP: DoD Network Information Center
- Type: Military
- Country: US.
What does this mean? As far as I’ve researched, its got something to do with Socks protocol? This Github repo I found seems to be using it too, but why is it used? If anyone knows, id very much appreciate your help.
edit1: formatting
edit2: Found an additional GH Repo that use the same IP addresses for something called V2RayVPNService: https://github.com/2dust/v2rayNG/blob/master/V2rayNG/app/src/main/kotlin/com/v2ray/ang/service/V2RayVpnService.kt
edit3: This blogpost explains it quite well. https://blog.erratasec.com/2013/12/dod-address-space-its-not-conspiracy.html
The reason all these address spaces are DoD is because that’s really the only source of unused IPv4 addresses left. All IPv4 address ranges have been assigned. But, the DoD has been assigned 20% of the IPv4 address space, but most of it is used within the DoD, on their own private networks, and is not routable to the outside world. Thus, if you are looking for a large chunk of “private” addresses that won’t suddenly one day be assigned to Akamai or Amazon (and thus, explode in your face), then DoD addresses are the way to go.
While it’s assigned public address, it’s only used inside the private DoD military network. Try tracerouting to that address space, you’ll see that your packets go nowhere.
Using dod address space in your vpn service means you will never conflict with the RFC 1918 private IPv4 addresses people use at home.https://blog.erratasec.com/2013/12/dod-address-space-its-not-conspiracy.html
Very interesting, had no idea this was a thing! Thanks for sharing.
It is also used here alongside of Google’s 8.8.8.8 : https://github.com/bndeff/socksdroid/blob/master/app/src/main/java/net/typeblog/socks/SocksVpnService.java
Found this, five year old thread, see the comments : https://old.reddit.com/r/VPN/comments/9oxae7/shadowsocks_from_google_play_store_compromised/
deleted by creator
Right so it is owned by Defense Information Systems Agency… thats… scary…
apps and things set their address space to use DOD ranges all the time. accidentally and on purpose. neither are 100% nefarious. 26’s were once used by shadowsocks.
Ah I wasnt not aware, the link provided by @anamethatisnt, seems to have cleared this up too!
could try https://ipalyzer.com/
nm, nothing added there
