img.batoto.net

[Batoto]

There are 3 servers which img.batoto.net points to:
 
95.211.184.225
95.211.148.229
46.165.221.7
 
All three of these entries are real separate servers set to distribute load.
 
The DNS servers for img.batoto.net is hosted by amazon cloud services, whom are:
ns-69.awsdns-08.com
ns-790.awsdns-34.net [205.251.195.22]
ns-1263.awsdns-29.org
ns-2030.awsdns-61.co.uk [205.251.199.238]
 
I can't say why David H. Lipman's nslookup resulted in other entries.

 

I'm also curious as to why 95.211.184.225 Is not a false positive. That server only has nginx as a service and is a content distribution node for only images. Is it possible to know why it was flagged to begin with?

[MysteryFCM]

I'm also curious as to why 95.211.184.225 Is not a false positive. That server only has nginx as a service and is a content distribution node for only images. Is it possible to know why it was flagged to begin with?

 

Please drop me an email. (sburn @ malwarebytes.org)