Yoda1953 Posted September 8, 2010 ID:311015 Share Posted September 8, 2010 I got this IP block in MBAM 85.17.184.224.Probably a false positive.IPnetinfo reports this:% This is the RIPE Database query service.% The objects are in RPSL format.%% The RIPE Database is subject to Terms and Conditions.% See http://www.ripe.net/db/support/db-terms-conditions.pdf% Information related to '85.17.184.0 - 85.17.184.255'inetnum: 85.17.184.0 - 85.17.184.255netname: LEASEWEBdescr: LeaseWebdescr: P.O. Box 93054descr: 1090BB AMSTERDAMdescr: Netherlandsdescr: www.leaseweb.comremarks: Please send email to "abuse@leaseweb.com" for complaintsremarks: regarding portscans, DoS attacks and spam.remarks: INFRA-AWcountry: NLadmin-c: LSW1-RIPEtech-c: LSW1-RIPEstatus: ASSIGNED PAmnt-by: OCOM-MNTchanged: ripe@leaseweb.com 20070730source: RIPEperson: RIP Meanaddress: P.O. Box 93054address: 1090BB AMSTERDAMaddress: Netherlandsphone: +31 20 3162880fax-no: +31 20 3162890abuse-mailbox: abuse@leaseweb.come-mail: ripe@leaseweb.comnic-hdl: LSW1-RIPEnotify: ripe@leaseweb.commnt-by: OCOM-MNTchanged: ripe@ocom.com 20050607changed: ripe@ocom.com 20060215changed: ripe@ocom.com 20060608changed: ripe@ocom.com 20080603source: RIPE% Information related to '85.17.0.0/16AS16265'route: 85.17.0.0/16descr: LEASEWEBorigin: AS16265remarks: LeaseWebmnt-by: OCOM-MNTchanged: ripe@ocom.com 20050311changed: ripe@ocom.com 20070610source: RIPE Link to post Share on other sites More sharing options...
ShyWriter Posted September 8, 2010 ID:311032 Share Posted September 8, 2010 It's not on hpHosts or MalwareDomain lists so it might be clean. The IP resolves out to softarchive.net and mail.softarchive.netIt passed IPVoid as clean and a few others as well.~Shy Link to post Share on other sites More sharing options...
Yoda1953 Posted September 8, 2010 Author ID:311033 Share Posted September 8, 2010 Thanks for the info. I'll check IPvoid as you mentioned from now on. Link to post Share on other sites More sharing options...
Yoda1953 Posted September 8, 2010 Author ID:311038 Share Posted September 8, 2010 How did you find the name softarchive.net. I only get leaseweb. Link to post Share on other sites More sharing options...
ShyWriter Posted September 8, 2010 ID:311039 Share Posted September 8, 2010 Thanks for the info. I'll check IPvoid as you mentioned from now on.I'd wait for an official reply from AdvancedSetup or MysteryFCM before I went there though. Sometimes MBAM blocks certain IPs because of the servers they're on, the whole IP block of numbers, etc. OR, softarchive.net *might* deal in grey software. ~ShyEDIT: Changed typo from .com to .net - Link to post Share on other sites More sharing options...
Yoda1953 Posted September 8, 2010 Author ID:311040 Share Posted September 8, 2010 Oh, I just found it. Just copy the IPaddress in firefox or other browser and presto .... Link to post Share on other sites More sharing options...
Yoda1953 Posted September 8, 2010 Author ID:311042 Share Posted September 8, 2010 I'd wait for an official reply from AdvancedSetup or MysteryFCM before I went there though. Sometimes MBAM blocks certain IPs because of the servers they're on, the whole IP block of numbers, etc. OR, softarchive.com *might* deal in grey software. ~ShyThanks, but what are those? (AdvancedSetup and MysteryFCM. And true .. softarchive.net has 'grey' software and the like. Link to post Share on other sites More sharing options...
ShyWriter Posted September 8, 2010 ID:311046 Share Posted September 8, 2010 Thanks, but what are those? (AdvancedSetup and MysteryFCM. And true .. softarchive.net has 'grey' software and the like.They can tell you why that IP is blocked by MBAM as they run the lists. ~ShyPS: To get the name of the site I went through a bunch of websites that track IPs, domains, email reps, site reps, etc, until I found it. There's probably an easier way but I just stumble along until I find out what I'm looking for. I have no official standing here and I'm not an expert - IP/DOMAINS are just a hobby of mine. BTW; even tho' MBAM blocked the site, when I did a Google search, Web of Trust, FinJan Secure Browsing and Browser Defender all said the site was OK. Grey software is not exactly a "warez" site but it's not an official distribution either.. Link to post Share on other sites More sharing options...
ShyWriter Posted September 8, 2010 ID:311049 Share Posted September 8, 2010 Use this site for one-stop shopping on IP/DOMAIN things.. Doesn't tell you if there's malware there but tells you everything else.http://www.robtex.com/Enter the IP or DOMAIN in the top left text box and click on SEARCH.~Shy Link to post Share on other sites More sharing options...
Yoda1953 Posted September 8, 2010 Author ID:311051 Share Posted September 8, 2010 Right, and thanx again. By the way softarchive.net IS a warez site Link to post Share on other sites More sharing options...
ShyWriter Posted September 8, 2010 ID:311052 Share Posted September 8, 2010 Right, and thanx again. By the way softarchive.net IS a warez site *laugh* Ok then.. NOW you know why it's being blocked by MBAM... ~Shy Link to post Share on other sites More sharing options...
Yoda1953 Posted September 8, 2010 Author ID:311058 Share Posted September 8, 2010 OK then but it doesn't block Nsanedown (site loaded with warez) and the like. I just bought a full lisence and I'm trying things out.Nice proggie hardly know its there (light on resources). Link to post Share on other sites More sharing options...
nosirrah Posted September 8, 2010 ID:311136 Share Posted September 8, 2010 Our IP/website researcher will comment on this thread later today, he is the one that maintains the list and does most of the research involved with it. Link to post Share on other sites More sharing options...
MysteryFCM Posted September 8, 2010 ID:311215 Share Posted September 8, 2010 Right, and thanx again. By the way softarchive.net IS a warez site This is not a false positive (and I suspect you already knew that, and knew exactly what the IP belonged to before the domain was even mentioned by ShyWriter). Aswell as warez, the site is involved in phishing (via nowdownloadall.com) etc, Leaseweb were already notified when this was first blocked, so as soon as the site is gone, the block will be removed. Link to post Share on other sites More sharing options...
ShyWriter Posted September 8, 2010 ID:311219 Share Posted September 8, 2010 This is not a false positive (and I suspect you already knew that, and knew exactly what the IP belonged to before the domain was even mentioned by ShyWriter). Aswell as warez, the site is involved in phishing (via nowdownloadall.com) etc, Leaseweb were already notified when this was first blocked, so as soon as the site is gone, the block will be removed.I kind of got that I'd been had when we got to the grey/warez portion of the comments. I was surprised tho' that all the sites I ran it through for ID said it was clean. In fact, I think I ran it through your hpHosts site and never got a ding either. I just can't figure out what I'm doing wrong when the sites I check pass the URL/IP-void scans and when I check them on Google, they show good via WOT, FinJan and Browser Defender??~Shy Link to post Share on other sites More sharing options...
MysteryFCM Posted September 8, 2010 ID:311221 Share Posted September 8, 2010 No idea about the rest but it is still in hpHosts http://hosts-file.net/?s=softarchive.net Link to post Share on other sites More sharing options...
Yoda1953 Posted September 9, 2010 Author ID:311388 Share Posted September 9, 2010 OK thanks all. And what about Nsanedown.com ? Link to post Share on other sites More sharing options...
MysteryFCM Posted September 9, 2010 ID:311393 Share Posted September 9, 2010 That's already been handled (I wasn't aware of it, which is why it wasn't listed in hpHosts, and wasn't blocked by MBAM). Link to post Share on other sites More sharing options...
Yoda1953 Posted September 10, 2010 Author ID:311897 Share Posted September 10, 2010 Yes, it is blocked now. You guys are fast! Link to post Share on other sites More sharing options...
Yoda1953 Posted September 10, 2010 Author ID:311898 Share Posted September 10, 2010 nsanedown.com IS listed in hphosts.I got a another one for you , which is listed in hphosts but not blocked by MBAM, empornium.us. A dangerous torrent porn website. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now