Compromised domains??  - Page 1
Forum section: electronics / general

author: HackedFridgeMagnet
author_rank: Super Contributor
timestamp: November 01, 2018, 04:50:13 am
content: At work my access to two domains has been barred.electricstuff.co.uksmallsmt.bizQuoteI can still see their YouTube channels but not their website. Especially annoying as I am looking around at PnP options.So are they compromised? My IT team seems to think so, they must read a list in from somewhere.

author: ataradov
author_rank: Super Contributor
timestamp: November 01, 2018, 05:03:04 am
content: There are services that IT people like to use. I think OpenDNS maintains one of those lists. Sometimes they actually report the file that they think is "bad". I had entire forums banned because of a single user-uploaded file.This system is stupid and generally achieves nothing, unless you employ complete idiots. But IT people need to do something, otherwise they get bored, so they install all sorts of BS.Also, going around those things is typically a violation of a company policy.PS: Asking IT in this case is useless, they are likely to be as informed about this as you are.

author: HackedFridgeMagnet
author_rank: Super Contributor
timestamp: November 01, 2018, 08:26:29 am
content: Quote from: ataradov on November 01, 2018, 05:03:04 amHmm.. kinda sounds about right.One day one of them tried to stop me handing out old RAM modules (instead of trashing them) because they were dangerous! Then (IIRC) I mentioned something about them not being dangerous as long as you chew properly.The next day a new policy came out forbidding the giving away of damaged computers or bits thereof.

author: station240
author_rank: Unknown
timestamp: November 01, 2018, 12:12:09 pm
content: I wouldn't assume this filter was IT's idea.In one big factory it was management, IT had to get a DSL line installed just so they could download drivers to re-install Windows etc.As the main internet was managed by the mess that passes for head office, there was no way to change settings.

author: hermit
author_rank: Frequent Contributor
timestamp: November 01, 2018, 02:50:27 pm
content: My last contract position was installing 'big name' firewall equipment. I was watching the logs to see what they thought was dangerous. They flagged 8.8.8.8 as a bot command and control site.Your IT department is probably blindly relying on information provided to them by a company that is going overboard because their reputation is at stake if they error in the other direction.Then again with Google I guess it is possible. Why else provide 'free' DNS service?

author: Simon
author_rank: Unknown
timestamp: November 03, 2018, 10:26:34 am
content: Business IT is a nightmare as they always go overboard and make doing the job hard.If a domain on the same server gets hacked and used to send spam and there is only 1 domain for the whole server any account on the same server will get a bad reputation and may be blocked.

author: janoc
author_rank: Super Contributor
timestamp: November 03, 2018, 11:00:43 am
content: Be glad that your company doesn't subscribe to the FortiNet and their FortiGuard spyware/censorware!In France a lot of public administration networks use this and you get websites randomly blocked as "pornography" or "illegal content" and what not.

author: Simon
author_rank: Unknown
timestamp: November 03, 2018, 11:04:35 am
content: No I just get given a laptop that I can't normally install programs on then they remove the admin account without warning that they agreed could be used for installs preventing you from preparing for EMC tests.

author: madires
author_rank: Super Contributor
timestamp: November 03, 2018, 11:21:37 am
content: The question is why those websites are considered compromised. Have you asked the IT department? There could be a sound reason like known malware delivered by a hacked CMS.

author: Simon
author_rank: Unknown
timestamp: November 03, 2018, 11:44:13 am
content: Any CMS hack that sends spam out will get the IP covering the whole server or several accounts flagged.

author: madires
author_rank: Super Contributor
timestamp: November 03, 2018, 12:41:43 pm
content: SPAMming servers will be listed in email RBLs. This is about blocked websites.

author: Simon
author_rank: Unknown
timestamp: November 03, 2018, 01:18:43 pm
content: Well I don't know who else uses the list and what else gets tracked. What I am saying is that if any account on the same server gets flagged for some reason and your company software uses that list it may have decided to block it. SSL certificates are also essential now or the site is flagged by a browser.

author: hermit
author_rank: Frequent Contributor
timestamp: November 03, 2018, 02:06:12 pm
content: One large firewall company that specialized in selling hardware had our servers blocked. I called to ask why. They had no reason other than they wanted a fee to delist us. I could have been a spammer but if I was willing to pay the fee I could get delisted. I informed them that unless they had a reason they could point to for blocking us and giving us a way to remedy the situation I'd file a complaint with the FCC as they were blocking emails from us and interfering with interstate commerce. They delisted us 'fee free'.

author: MrMobodies
author_rank: Super Contributor
timestamp: November 03, 2018, 02:23:49 pm
content: A couple of months ago I had some problems where hostnames were not resolving.They were resolving to outside addresses belonging to Level3.I was getting redirected to their landing page and their adverts when I type a url wrongly in the browser or an hostname.On my other stuff it did the same.It turns out to be one of the DNS to Level3 I use on my firewall.I removed it and cleared the cache and the hostnames were pingable again.Level3 DNS posioning.Not happy.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: November 03, 2018, 02:56:56 pm
content: Quote from: madires on November 03, 2018, 11:21:37 amI checkedwww.electricstuff.co.ukfor a few things.I highly doubt anything like a hacked CMS hosting malware is to blame - Mike doesn't even use a CMS on his site! Static HTML only.Checking the IP againstspam blacklistsreturns nothing, doesn't feature in Google'sSafe Browsinglists for unsafe content, nor a few lists for knownphishingormalwarecontent. Also negative in a list ofcompromised domains.So either it's a mistaken entry, or mis-classified as unsecure when it may have been intended to list as 'undesired content' or something.

author: Simon
author_rank: Unknown
timestamp: November 03, 2018, 03:04:59 pm
content: My experience of IT is that they go over the top and make work by causing problems. We never had an IT department and never had a problem. Now we have an IT department at our head office 100's of miles away and they cause havoc, most of their work is "self generated" by the mess they cause.

author: MrMobodies
author_rank: Super Contributor
timestamp: November 03, 2018, 03:39:34 pm
content: It is always nice to have your IT department local.Not always easy explaining things to them over phone.

author: madires
author_rank: Super Contributor
timestamp: November 03, 2018, 05:12:40 pm
content: Quote from: Simon on November 03, 2018, 01:18:43 pmAFAIK, most website categorizing lists list the URL and not the server's IP address which would create a collateral damage for other websites hosted on the same server. SSL certs are a different story. Trying to enforce TLS on all websites doesn't magically make the web secure.

author: madires
author_rank: Super Contributor
timestamp: November 03, 2018, 05:14:17 pm
content: Quote from: hermit on November 03, 2018, 02:06:12 pmThat's gross! Name and shame!

author: madires
author_rank: Super Contributor
timestamp: November 03, 2018, 05:17:28 pm
content: Quote from: MrMobodies on November 03, 2018, 02:23:49 pmYou could run your own resolver (bind, unbound, etc).

author: MrMobodies
author_rank: Super Contributor
timestamp: November 03, 2018, 05:40:41 pm
content: Quote from: madires on November 03, 2018, 05:17:28 pmYes I have another up to date Pfsense firewall with resolver there that I am experimenting on.This one has been going for nearly four years and I don't to run the update and disrupt everything.

author: Simon
author_rank: Unknown
timestamp: November 03, 2018, 06:08:09 pm
content: Quote from: madires on November 03, 2018, 05:12:40 pmMy entire server IP was blocked due to one hacked domain. Domains resolve to IPs the whoes domain it is is decided by the server, for the rest of the web it is the IP unless you have a dedicated IP you get black listed at server level.

author: hermit
author_rank: Frequent Contributor
timestamp: November 03, 2018, 06:42:53 pm
content: Quote from: madires on November 03, 2018, 05:14:17 pmIt looks like they currently have an automated system. I can't get their pay portal to come up at the moment. But to avoid liability let's use someone else.https://community.spiceworks.com/topic/175545-emailreg-org-a-scam-shame-on-you-barracuda"So, we switched ISP,s and suddenly got a lot of sent email messages were rejected by Barracuda. I jumped though the hoops Barracuda said to, and even paid $20 to an outfit called Emailreg.org. But I smelled a rat, and a goole search turned up this:http://joystickjunkie.blogspot.com/2010/04/emailregorg-is-scam.htmlSo, fair warning out there to my other spiceheads. Has anyone else fallen victim to this? "http://joystickjunkie.blogspot.com/2010/04/emailregorg-is-scam.html

author: HackedFridgeMagnet
author_rank: Super Contributor
timestamp: November 03, 2018, 11:33:24 pm
content: Quote from: MrMobodies on November 03, 2018, 02:23:49 pmI did a tracert and co.uk traced to london before stopping and .biz went to US im pretty sure before it too couldnt get all the way.So I am pretty sure the dns is resolving correctly.Quote from: HwAoRrDk on November 03, 2018, 02:56:56 pmStatic pages only... I just remembered why I was looking.He has a forum too, using the same backend as EEVBlog.http://electricstuff.co.uk/forum/that could have been compromised??Anyway the IT people in their infinite wisdom changed my issue to resolved. Even though It is still a problem, I posted a comment to say it isn't actually fixed, how do you know its compromised? but no response.I will log another issue and ask them not to close it until I at least have a sensible answer.

author: HackedFridgeMagnet
author_rank: Super Contributor
timestamp: November 28, 2018, 11:18:38 am
content: I Forgot to update this thread. this was resolved about a week or two ago.So I logged the same issue again and pointed to the previous issue.My new issue was immediately moved to priority a priority level of "planning".there it sat for eight days.So after wait for eight days, I looked up the Head of IT for the whole organisation. (> 10k) users, I emailed him told him my problems, told him his IT issue system is being misused and that I would like some action.It got fixed next day, after that the IT bods sent me a bit fair bit of paperwork as payback.I think my name is dirt in the IT section now, but at least I can browse where I need.

author: Wan Huang Luo
author_rank: Regular Contributor
timestamp: November 28, 2018, 07:05:20 pm
content: Quote from: hermit on November 01, 2018, 02:50:27 pmHaha, years ago I'd say 'cobblers' to that.. but now..

author: boffin
author_rank: Unknown
timestamp: November 28, 2018, 08:37:46 pm
content: Quote from: hermit on November 03, 2018, 02:06:12 pmHad the same problem with SORBS (who run email blocking lists). They listed us as bad, because we bounced a spam email (per the RFC - the envelope from was one of their honeypots). When they wanted a fee, I asked their ISP (and CC'd them) why they would host an organization that blocked people for following RFCs, we were unblocked quickly.

author: jmelson
author_rank: Super Contributor
timestamp: November 28, 2018, 08:53:21 pm
content: Quote from: Simon on November 03, 2018, 10:26:34 amYes, this is slowly driving me nuts!I have a business internet service through a big cable provider (Charter Spectrum). I participate in a bunch of mailing lists. One of the spam-flagging services flags several of Charter's outgoing SMTP servers as a source of spam. So, when I send messages to those lists, depending on which server happened to process that message, it may get rejected.So, I got a gmail account. That worked fine for a while, but then another mailing list started rejecting all messages sent through gmail servers.So, I contacted Charter's people to try to get this resolved, but they couldn't care less.These spam flagging services appear to be a BIG scam, their entire business model seems to be asking people to pay to get their computers off the list.So, I have to keep switching which outgoing mail server I send messages to, depending on which list I'm replying to. WATTA pain!Jon

author: boffin
author_rank: Unknown
timestamp: November 28, 2018, 10:37:34 pm
content: Quote from: jmelson on November 28, 2018, 08:53:21 pmYou'll find that a lot in the computer security industry; especially anti-spam. For example,if you're blocked with Baracuda's email appliances, they'll recommend a service which will help you get unlisted (emailreg.org), which unsurprisingly, they own.if you're blocked with Ironport (cisco) email appliances, they'll recommend a service (can't remember the name) which surprise surprise, they own.Even ratings of anti-virus products aren't immune. Virus-Bulletin has given a VB100 rating to Sophos for a very long time, guess who owns them