I ran the
who command on a shared NetBSD box, and this weird user IP came up:
<redacted> pts/33 May 13 02:13 (XXX.XXX.XXX.XXX) <redacted> pts/35 May 12 20:59 (202-172-110-147-) <redacted> pts/36 May 6 20:36 (XXX.XXX.XXX.XXX)
I've never seen an IP like that. Obviously,
ping 202-172-110-147- will complain with "Cannot resolve ... (Unknown host)".
There was a similar question posted 7 years ago, which posited that it was a non-standard way of denoting IP ranges, but seeing there's a
- at the end of the address, it doesn't seem like a similar thing.
I've tried reverse DNS with
nslookup 202-172-110-147-, which errors with "** server can't find 202-172-110-147-: NXDOMAIN"
w <user> returns:
9:49AM up 89 days, 7:46, 1 user, load averages: 0.23, 0.18, 0.17 USER TTY FROM LOGIN@ IDLE WHAT <redacted> pts/35 202-172-110-147- Tue08PM 4:13
Edit 2: This is on NetBSD, not Linux like I mentioned at the beginning (I thought the box was Linux):
$ uname -rsv NetBSD 8.1 NetBSD 8.1 (GENERIC) #0: Fri May 31 08:43:59 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC
Edit 3: Following @NStorm update, I ran
w -n to display network addresses as numbers. I still see the same result
$ w -n <user> 9:57AM up 89 days, 7:54, 1 user, load averages: 0.12, 0.12, 0.14 USER TTY FROM LOGIN@ IDLE WHAT <redacted> pts/35 202-172-110-147- Tue08PM 4:22