Glossary: Logs and Data Sources for Investigations

Host addresses (127.0.0.1, 0.0.0.0)

Also written: 127.0.0.1, localhost, loopback address, 0.0.0.0

127.0.0.1 (localhost) is the address a computer uses to reach itself, so 'from 127.0.0.1' in the DNS log meant the shop server itself looked up the attacker's domain. 0.0.0.0 means 'every address on this machine' when a service listens on it, or 'no address yet'.