What the heck: three.net.au redirecting to www.policywording.com.au

3 is my mobile carrier. It offers an online service which allows its customers to check the current usage from their phones by accessing this URL: three.net.au/my3/gethome.do.

Usually it works quite well, but not today (and probably some more days to come), it gave me a HTTP ERROR 404.  I thought I should just visit http://three.net.au and find out w-t-h is wrong. Unexpectedly it took me to another site — “callenden group policy wording”. It’s very weird so with some spare time, I decided to do a little investigation.

First let’s check who owns three.net.au:


$ whois three.net.au
Domain Name: three.net.au
Last Modified: 30-Sep-2010 11:52:55 UTC
Registrar ID: Melbourne IT
Registrar Name: Melbourne IT
Status: ok


Registrant: Three Management Pty Ltd
Registrant ID: ABN 84096981529
Eligibility Type: Registered Business

Registrant Contact ID: MIT508840C
Registrant Contact Name: Peter Tay
Registrant Contact Email: Visit whois.ausregistry.com.au for Web based WhoIs

Tech Contact ID: MIT966930C
Tech Contact Name: Ben Doyle
Tech Contact Email: Visit whois.ausregistry.com.au for Web based WhoIs

Name Server: edns.wyith.net
Name Server: ns3.wyith.net
Name Server: ns4.wyith.net

Now let’s find out the IP address of three.net.au:

$ dig three.net.au
; <<>> DiG 9.7.1-P2 <<>> three.net.au
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17680
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3

;; QUESTION SECTION:
;three.net.au. IN A

;; ANSWER SECTION:
three.net.au. 5393 IN A 202.139.248.52

;; AUTHORITY SECTION:
three.net.au. 5393 IN NS ns4.wyith.net.
three.net.au. 5393 IN NS edns.wyith.net.
three.net.au. 5393 IN NS ns3.wyith.net.

;; ADDITIONAL SECTION:
ns3.wyith.net. 84592 IN A 202.181.231.99
ns4.wyith.net. 84592 IN A 202.181.231.100
edns.wyith.net. 84592 IN A 202.181.240.44

;; Query time: 0 msec
;; SERVER: 192.168.1.132#53(192.168.1.132)
;; WHEN: Fri Dec 10 00:14:48 2010
;; MSG SIZE rcvd: 158

According to the query result, three.net.au points to this IP address: 202.139.248.52.
192.168.1.132 is my own DNS server, therefore it may have cached the results. Let’s try to dig against the domain’s DNS servers instead.


$ dig @202.181.231.99 three.net.au

; <<>> DiG 9.7.1-P2 <<>> @202.181.231.99 three.net.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7925
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;three.net.au. IN A

;; ANSWER SECTION:
three.net.au. 7200 IN A 202.139.248.52

;; AUTHORITY SECTION:
three.net.au. 7200 IN NS ns3.wyith.net.
three.net.au. 7200 IN NS edns.wyith.net.
three.net.au. 7200 IN NS ns4.wyith.net.

;; ADDITIONAL SECTION:
edns.wyith.net. 86400 IN A 202.181.240.44
ns3.wyith.net. 86400 IN A 202.181.231.99
ns4.wyith.net. 86400 IN A 202.181.231.100

;; Query time: 211 msec
;; SERVER: 202.181.231.99#53(202.181.231.99)
;; WHEN: Fri Dec 10 00:19:17 2010
;; MSG SIZE rcvd: 158

We still get the same result. I did also dig against 202.181.231.99 and 202.181.231.100 which yield the same results.

Now let’s do a reverse lookup of 202.139.248.52.

$ dig -x 202.139.248.52

; <<>> DiG 9.7.1-P2 <<>> -x 202.139.248.52
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54308
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3

;; QUESTION SECTION:
;52.248.139.202.in-addr.arpa. IN PTR

;; ANSWER SECTION:
52.248.139.202.in-addr.arpa. 116 IN PTR http://www.policywording.com.au.

;; AUTHORITY SECTION:
248.139.202.in-addr.arpa. 116 IN NS bne001n.server-dns.com.
248.139.202.in-addr.arpa. 116 IN NS wic001n.server-dns.com.au.
248.139.202.in-addr.arpa. 116 IN NS sjc001n.server-dns-us.com.

;; ADDITIONAL SECTION:
bne001n.server-dns.com. 116 IN A 203.147.241.3
sjc001n.server-dns-us.com. 116 IN A 203.27.226.35
wic001n.server-dns.com.au. 116 IN A 203.147.142.1

;; Query time: 0 msec
;; SERVER: 192.168.1.132#53(192.168.1.132)
;; WHEN: Fri Dec 10 00:26:17 2010
;; MSG SIZE rcvd: 236

52.248.139.202.in-addr.arpa. 116 IN PTR http://www.policywording.com.au.

This explains why visiting three.net.au shows you the webpage of http://www.policywording.com.au.

My bet is that someone who looks after the DNS of three.net.au domain must have entered the wrong IP address for three.net.au. If I have a bit of free time, I’ll give ’3′ customer service a call and get them fix this annoying error.

About these ads

2 thoughts on “What the heck: three.net.au redirecting to www.policywording.com.au

  1. Jayen says:

    dig +trace is the proper way to bypass the cache with dig.

    also, do you honestly think the customer service representative is going to know what an IP address is?

  2. Kenno says:

    Thanks for the dig +trace tip.

    If not the customer service, who do you suggest I should report about this?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: