Recently provisioned VS

Viruses and worms
1

Hi,

I have a recently provisioned virtual server and everytime I access it via IP, I get a URL:Mal popup from Avast which blocks me from viewing the site. There is absolutely nothing new installed, except for a LAMP stack. I spoke with the hosting team and they found nothing that could be triggering this error and suggested I find out with Avast what may be causing this…

I have no problems with trying to whitelist this IP in the software (if there is a way to do it) but am worried that other Avast users get the same error upon entering the site. Is this IP blocked?

The IP in question:

hxxp://108.161.129.31/

2

This happens with all the browsers I try and is being blocked by the network shield.

3

URL:mal means URL or IP is on a blacklist for whatever reason…it does not have to be infected

your IP is blacklisted here http://www.apews.org/

CASE: C-131 Unallocated CIDR, no traffic until allocated, or allocated to bad reputation provider or allocated but dynamic / generically named IPs, or bogons, see www.cidr-report.org, or orphaned IP / CIDR in routing table

if you think this is wrong, report it to avast lab here http://www.avast.com/contact-form.php (select subject according to Your case)
you may give a link to this topic in case they reply here

4

Here is see no listing: http://www.dnsbls.com/tlcbags.com
nor here: http://www.dnsbltools.com/108.161.129.31

The recent flags were with 4 connections first seen 22 months ago last seen 4 weeks ago
Threat listed on DShield Block List Danger level 3
same with threats as COMMUNITY and ADVANCED also threat danger level 3.

There is an empty website now there: http://urlquery.net/report.php?id=9619550
domainname for the site has not been delegated yet:
Only one IPv4 name server was found for the zone.
You should always have at least two IPv4 name servers for a zone to be able to handle transient connectivity problems.

apews states:
Unallocated CIDR, no traffic until allocated,
or allocated to bad reputation provider
or allocated but dynamic / generically named IPs,
or bogons, see www.cidr-report.org,
or orphaned IP / CIDR in routing table
See domain name being locked: http://www.whoismind.com/whois/paradisecapitalsvr.com.html
address is unreachable
This domain on IP is also being locked: http://www.whoismind.com/whois/hostelinfamily.com.html

So it has nothing to do with the recently provisioned VS,
must be just a pretext, as your issues already stem mid 2013,

polonus

5

Woah, that sucks…

Asked for a new ip address, took about 5min to get a new one setup by the hosting company. Thanks for the info!

6

Glad we could be of help to make you aware.
Hope you will stay safe and secure,

polonus