Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 3 down vote favorite

I think I'm experiencing some kind of local DNS issue. I just noticed today that when I tried to visit www.grooveshark.com, the url is being mapped to 127.0.0.1, because I'm being served by my home web server:

enter image description here

I've had my web server up and running on my machine on port 80 for forever. This is the first time I've ever seen it get served up in place of a site like this. It seems to me as though some sort of ad blocking software is trying to block grooveshark.com by redirecting all requests to 127.0.0.1.

I've heard of doing things like this with one's 'hosts' file, but I've never mucked about with that. I know adblock plus doesn't have a rule for grooveshark. Other than that, all I can think of is that I've recently performed a scheduled update and run of Spybot S&D like I do every few weeks.

NS Lookup

> nslookup www.grooveshark.com
Server:  UnKnown
Address:  192.168.1.1

Non-authoritative answer:
Name:    grooveshark.com
Address:  8.19.240.53
Aliases:  www.grooveshark.com
share|improve this question
2  
Try a nslookup www.grooveshark.com to find out what you recieve from dns. – Jens Erat Oct 25 '11 at 21:15
@Ranon - Added, thanks. Looks like DNS isn't the problem. – Alain Oct 25 '11 at 21:22
2  
Note that grooveshark.com (which you are trying to open) and www.grooveshark.com (which you are giving to nslookup) are technically two different domains. It just happens that in this particular case one is an alias to another, but @Ranon, don't forget the difference. – grawity Oct 25 '11 at 21:29
Looks fine, this domain resolves to the same IP address with me. Still having problems? Having problems in all browsers? @grawity Hadn't seen it in address bar yet. Alain: www.grooveshark.com in browser doesn't work either? – Jens Erat Oct 25 '11 at 21:30
2  
@Alain: Have you checked %SystemRoot%\system32\drivers\etc\hosts if it contains the Grooveshark domain? (nslookup does not read that file.) Also, is either browser configured to use a proxy server? – grawity Oct 25 '11 at 21:30
show 1 more comment

1 Answer

up vote 8 down vote accepted

As it turned out, Spybot S&D's "Immunize" feature blocks grooveshark.com using the /etc/hosts file.

This has already been reported and confirmed as a false positive, and will be fixed in today's update according to the forum post.

The detection on cloudfront.net will be narrowed down to the subdomain that is used to host malware. Grooveshark.com relation to malware will be reviewed since it was advertised by malware and hides its registration information via Domains by Proxy which is suspicious by default for any commercial site.

Update:
Further analysis of the malware showed that it tried to load a media file at Grooveshark.com which is not present anymore. Therefore Grooveshark will be removed from detection with the next detection update scheduled for Wednesday 2011-10-26.

– Yodama

share|improve this answer
4  
On a related note: Blocking domains by pointing them to 127.0.0.1 is not particularly good practice, since they are likely to hit a locally-running web server. An invalid host IP address such as 0.0.0.0 would be better. – grawity Oct 25 '11 at 21:43
I agree. Great find on the false positive report, and thanks. – Alain Oct 25 '11 at 21:50
But it wasn't redirected to 127.0.0.1... his nslookup result above shows 192.168.1.1, which is very much different. Very odd. – lornix Oct 25 '11 at 23:27
3  
@lornix: First, no, nslookup shows 8.19.240.53 as the result. The 192.168.1.1 address you see is the DNS server's address. Second, as I mentioned in an earlier comment, nslookup does not use /etc/hosts - it is specifically designed to query DNS directly. – grawity Oct 25 '11 at 23:35
Whoops, yes, you're right, my mistake, sorry about that. Evidently my caffeine level is low again. I should have keyed on the fact that 192.168.1.1 is usually a user's router too. {sigh} – lornix Oct 25 '11 at 23:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.