Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I think I'm experiencing some kind of local DNS issue. I just noticed today that when I tried to visit, the url is being mapped to, because I'm being served by my home web server:

enter image description here

I've had my web server up and running on my machine on port 80 for forever. This is the first time I've ever seen it get served up in place of a site like this. It seems to me as though some sort of ad blocking software is trying to block by redirecting all requests to

I've heard of doing things like this with one's 'hosts' file, but I've never mucked about with that. I know adblock plus doesn't have a rule for grooveshark. Other than that, all I can think of is that I've recently performed a scheduled update and run of Spybot S&D like I do every few weeks.

NS Lookup

> nslookup
Server:  UnKnown

Non-authoritative answer:
share|improve this question
Try a nslookup to find out what you recieve from dns. – Jens Erat Oct 25 '11 at 21:15
@Ranon - Added, thanks. Looks like DNS isn't the problem. – Alain Oct 25 '11 at 21:22
Note that (which you are trying to open) and (which you are giving to nslookup) are technically two different domains. It just happens that in this particular case one is an alias to another, but @Ranon, don't forget the difference. – grawity Oct 25 '11 at 21:29
Looks fine, this domain resolves to the same IP address with me. Still having problems? Having problems in all browsers? @grawity Hadn't seen it in address bar yet. Alain: in browser doesn't work either? – Jens Erat Oct 25 '11 at 21:30
@Alain: Have you checked %SystemRoot%\system32\drivers\etc\hosts if it contains the Grooveshark domain? (nslookup does not read that file.) Also, is either browser configured to use a proxy server? – grawity Oct 25 '11 at 21:30
up vote 8 down vote accepted

As it turned out, Spybot S&D's "Immunize" feature blocks using the /etc/hosts file.

This has already been reported and confirmed as a false positive, and will be fixed in today's update according to the forum post.

The detection on will be narrowed down to the subdomain that is used to host malware. relation to malware will be reviewed since it was advertised by malware and hides its registration information via Domains by Proxy which is suspicious by default for any commercial site.

Further analysis of the malware showed that it tried to load a media file at which is not present anymore. Therefore Grooveshark will be removed from detection with the next detection update scheduled for Wednesday 2011-10-26.


share|improve this answer
On a related note: Blocking domains by pointing them to is not particularly good practice, since they are likely to hit a locally-running web server. An invalid host IP address such as would be better. – grawity Oct 25 '11 at 21:43
I agree. Great find on the false positive report, and thanks. – Alain Oct 25 '11 at 21:50
But it wasn't redirected to his nslookup result above shows, which is very much different. Very odd. – lornix Oct 25 '11 at 23:27
@lornix: First, no, nslookup shows as the result. The address you see is the DNS server's address. Second, as I mentioned in an earlier comment, nslookup does not use /etc/hosts - it is specifically designed to query DNS directly. – grawity Oct 25 '11 at 23:35
Whoops, yes, you're right, my mistake, sorry about that. Evidently my caffeine level is low again. I should have keyed on the fact that is usually a user's router too. {sigh} – lornix Oct 25 '11 at 23:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .