SpacemanSpiff Posted November 10, 2014 Share Posted November 10, 2014 Hi all. My report was unable to resolve an IP address for http://doctorketsar,ru, yet when I attempt to go to the website, Avast blocks it with a warning of Malware on the site. The only way I can think this possible is if the site is currently between hosts and Avast is warning from a stored database as opposed to a realtime threat. [Which I think would be problematic] Is that basically it, or is there something else going on with this site? Thanks. Link to comment Share on other sites More sharing options...
Lking Posted November 10, 2014 Share Posted November 10, 2014 SpacemanSpiff I broke the link in your post. We would not want any users to inadvertently click on an active link and end up in an unintended mess. Nor would we want search engines to index this rogue site. Link to comment Share on other sites More sharing options...
Farelf Posted November 10, 2014 Share Posted November 10, 2014 Thanks Lou. Calvin, there is a real problem with the internet address for that site. Finding the authoritative name servers: C:\Documents and Settings\Admin>nslookup -type=ns doctorketsar.ru 8.8.8.8Server: google-public-dns-a.google.comAddress: 8.8.8.8Non-authoritative answer:doctorketsar.ru nameserver = ns2.reg.rudoctorketsar.ru nameserver = ns1.reg.ru - and applying one of those to find the address C:\Documents and Settings\Admin>nslookup doctorketsar.ru NS1.REG.RUServer: ns1.reg.ruAddress: 31.31.204.37*** No address (A) records available for doctorketsar.ru - (the IP address is just that of the name server) the site's own nameservice doesn't know where it is right now. That could be symptomatic of all sorts of things but in any event may explain why the parser didn't find it and, if there are cached results on other (non-authoritative name servers) there are variable results with (supposed) resolution. To take up on Lou's point, for future reference - it is best, for that and other reasons to discuss report results by referencing the Tracking URL from the head of the parser, That's from the bit (like): SpamCop v 4.8.2.018 © 2014 Cisco Systems, Inc. All rights reserved.Here is your TRACKING URL - it may be saved for future reference:http://www.spamcop.net/sc?id=z6004591162zcd0ba8999cb1c4287cf17331cf51c54fz Regards, Steve S Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.