Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by capableweb on Tuesday March 02, 2021 @09:36AM
(#26315721)
Ultimately up to the owner of the ASN what to use as the organization name. In this case, the ASN chose the name "Tencent Building, Kejizhongyi Avenue", you can see it over at https://bgp.he.net/AS132203 (The ASN is the owner of this specific IP under their specific ranges that they own)
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by robjan on Tuesday March 02, 2021 @09:38AM
(#26315739)
Looks like the first line of the address for the headquarters of Tencent Cloud in Shenzhen.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by dthul on Tuesday March 02, 2021 @09:36AM
(#26315722)
That surprised me too (the IP lookup I used said "domain: tencent.com") but I don't understand enough about IP to tell whether that's unusual or not.
Unrelated tidbit: tencent.com returns an empty reply for me at the moment.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by capableweb on Tuesday March 02, 2021 @09:39AM
(#26315745)
> tencent.com returns an empty reply for me at the moment
That's because the correct address is https://www.tencent.com/ (prefixed with www.)
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by sodality2 on Tuesday March 02, 2021 @09:42AM
(#26315780)
Wow. Can the massive chinese conglomerate really not forward that to www?
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by basilgohar on Tuesday March 02, 2021 @09:57AM
(#26315946)
They are hardly the only site to do that. It is only by convention that non-www-prefixed websites tend to redirect to www-prefixed one. It's not at all mandatory and technically they are two different hostnames. It may be intentional to ensure only exactly the right hostnames are ever used, e.g., www, ftp, smtp, etc.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by oefrha on Tuesday March 02, 2021 @11:54AM
(#26317338)
Rather unusual, but it’s a corporate rather than customer-facing website so not really all that important. It’s not like apple.com, google.com, or microsoft.com where the brand name domain is the product or is where the products are sold. I just checked and apex domains for all their flagship products redirect to www just fine.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by deelowe on Tuesday March 02, 2021 @10:08AM
(#26316051)
Seems to be working as intended, it's a non www url.
https://ipapi.co/101.32.99.28/