3

I did an nmap scan on a website that is being hosted by a hosting company. The results showed a rDNS record with an ip and a domain name. When I googled the domain name it appeared in malwaredomainlist.com. Does this mean this server is hosting malware along with websites? Are domains listed in malwaredomainlist.com compromised? If so should I contact the hosting company?

1
  • There are also some servers on that list which were never compromised: serving malware is exactly what the owner wants it to do.
    – Philipp
    Nov 22, 2015 at 10:20

3 Answers 3

2

“Immortal” Malware Domains are those which were identified as malicious anywhere between 90 and 360 days ago. but according to google safebrowsing, are still actively involved in badness. Some of these domains have been on the DNS-BH List for YEARS.

This is quoted from the website you mentioned. This means it all depends if what you found is a recent or old news. Also try to navigate that website using Google Safe Browsing (activated by default on Google Chrome, Mozilla Firefox and Apple Safari). If the website is still hosting a malware you will see something like this:

enter image description here

You can not know if only the website is compromised or all the server that hosts it too (in which case the company that owns it should have done the necessary to clean it already, but as mentioned before the infection could last for many reasons). You can not know because it depends on the way the attack was done and the security architecture of the hosting company (server).

Also, one thing to know is that lot of websites are blacklisted not because they host themselves badware but they simply redirect to other compromised websites.

You may also check if the domain is infected on this powerful service.

Before hiring that domain, better to contact the company first and talk to them about this issue.

1

It only indicates that this domain was once added to the list of malware domains because somebody reported it. It does not indicate that the site had ever malware on it (might be a false report) or that it has now malware on it (might got cleaned in the mean time). You should also check the date of the entry to see if it is a recent one or an old one - there are some recent but lots of very old entries (from 2009) in the list.

You better only report the entry to the hosting company if you are sure that there is still malware on it, i.e. if you can reproduce the report in the malware domain list.

0

Lists is lists. If somebody is on a "no fly" list, are they a terrorist? Not necessarily, but that doesn't make the whole list useless.

The list is a defence, not an oracle. You might mention to the hosting company that the IP is on a list, rather than saying "you got malware".

Try virustotal and wepawet if you want to do some investigation, but take care.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.