DNS lookup resolves to 127.0.0.1

[allusive]

Recently I received a spam on a Comcast email account. Ever since the Comcast hack many years ago, that account has received 1000's of spam and scam emails. One thing that I like to do from time to time is report them, to frustrate the spammers.

Today I got an unusual spam. There's an image file embedded in it (not unusual) but it links to mailchannels.net. When I did my usual whois and ping to learn who that really is, I got back 127.0.0.1.

I figured something must be amiss with my Wifi router's DNS cache, so I switched to using 8.8.8.8. I got the same result.

I then realized the full domain is click.mailchannels.net, which is Amazon, so I alerted their trust and safety team.

Still, I wonder, when new DNS entries are created and propagated, who if anyone reviews these to make sure they are not localhost? And why would the base domain mailchannels.net be 127.0.0.1 in the first place, when the subdomain has a normal AWS IP?

 

[PHolder]

It's a pretty common way to kill a [mal] site by putting in a hosts file entry and pointing it at localhost. That way the host resolves (as using 0.0.0.0 would not, for example) and probably quickly fails rather than timing out. Perhaps they chose it for those reasons. I don't think there is any "enforcement" of DNS entries that I am aware of, unless an individual DNS server hosting service were to have specific rules they enforced.

 

[peterblaise]

"... spam and scam emails ...I like to ... ​

report them, to frustrate the spammers ..."​

As far as I can speculate, all reporting or
responding or trying to cancel in any way does
is confirm we have a live email address and
are therefore more valuable in the resale of
the next proven-active list.

Technical reference: why 127.0.0.1

Spam often originates from or features domain names that resolve to \(127.0.0.1\) (localhost/loopback) due to specific technical tactics used by bad actors: [1, 2, 3]

• Spam & Phishing Tracking: Spammers embed unique domains in emails to track who opens them. By pointing these domains to \(127.0.0.1\), they protect their actual servers from being exposed to security researchers or authorities. [1, 2, 3, 4, 5]
  
  
• Dead-End Resolution: When a campaign ends, a spammer might intentionally change a domain's DNS "A record" to \(127.0.0.1\). This absorbs and safely discards any residual traffic or automated security scans directed at the domain. [1, 2, 3, 4]
  
  
• Testing & Pre-Validation: Spammers often test their phishing scripts or email payloads on local developer machines before a campaign. They assign the domain to \(127.0.0.1\) locally so the link returns to their machine during testing. [1]
  
  
• Anti-Tracking & Malvertising: Advertisers or malicious actors can use it as a "sinkhole" to prevent users' browsers from connecting to undesirable third-party scripts without breaking the page layout. [1]

To check domain IPs safely, you can use lookup tools like MXToolbox or verify blacklists via Spamhaus. [1, 2]

 

[EdwinG]

Still, I wonder, when new DNS entries are created and propagated, who if anyone reviews these to make sure they are not localhost? And why would the base domain mailchannels.net be 127.0.0.1 in the first place, when the subdomain has a normal AWS IP?

There’s a simple answer. No one.

The DNS zone administrator (mailchannels.net administrator in this case) is responsible for their own DNS records.

They can point it to wherever they want, even if it is usually towards something they control. These records are not even propagated; they are retrieved upon the first request and then cached in the resolvers caches.