Does anyone know why opendns thinks pool.nt.org is malware site?

1 pool.ntp.org Malware 10

This malware site was blocked for your protection. You can make an exception for this domain or stop blocking malware sites .

typo it should be pool.ntp.org

Also is the error message from OpenDNS or your own virus software? pool.ntp.org has several different ip addresses that change depending on your location, one of these may be incorrectly listed as a possible malware site in your anti virus software.

Just to fill in some blanks. The ip address 82.98.86.170 associated with pool.nt.org
(not pool.ntp.org) does have prior associations with RBN and spam activity. It may have been set up to catch people accidentally typing this address like in your first post.

thanks birkira but I stated previously that I had mistyped pool.nt.org instead of pool.ntp.org so obviously that is not the case

I didnt say is was blocked it turn up as "Malware/Botnet Activity Detected" on the opendns website dashboard.

Appears just recently pool.ntp.org was added as malware as I have 826 requests blocked for pool.ntp.org as a malware site. I also am wandering why this is. It was not blocked last week.

Ok, I just checked all ten variations of pool.ntp.org that OpenDNS has in its tagging database and none of them are marked as or even have as little as one vote towards malware. Those having an issue need to ask support for an answer as clearly it is not happening to all users.

Again none of these sites are tagged as malware when you search for them in the tagging database and none appear in any of my OpenDNS based networks as malware. Please contact support. When support has given an answer let us all know as it is an intriguing mystery for some as well as an inconvenience for other users.

You are right but as a malware moderator I can see that database as well.

@nmcsafety
Post the complete plain text output of the following commands here (trailing dots are part of them!):
nslookup -type=txt debug.opendns.com.
nslookup pool.ntp.org.

I'll post some nslookup output. (Our own addresses sanitized out of habit.) Posting the two nslookups you requested, but our reports don't list pool.ntp.org as being malware, so I'm also posting an nslookup for one that is (0.pool.ntp.org).

So it appears that pool.ntp.org lookups are succeeding, but that (in our case) the Dashboard is erroneously reporting them as being blocked. Puzzling. Here's that output.

**********

$ nslookup -type=txt debug.opendns.com
Server: 10.1.2.3
Address: 10.1.2.3#53

Non-authoritative answer:
debug.opendns.com text = "server 4.pao"
debug.opendns.com text = "flags 20 0 7e6 100000000000"
debug.opendns.com text = "id 8807571"
debug.opendns.com text = "source 204.72.79.220:22016"

Authoritative answers can be found from:


$ nslookup pool.ntp.org
Server: 10.1.2.3
Address: 10.1.2.3#53

Non-authoritative answer:
Name: pool.ntp.org
Address: 69.167.160.102
Name: pool.ntp.org
Address: 96.44.142.5
Name: pool.ntp.org
Address: 199.4.29.166


$ nslookup 0.pool.ntp.org
Server: 10.1.2.3
Address: 10.1.2.3#53

Non-authoritative answer:
Name: 0.pool.ntp.org
Address: 208.87.104.40
Name: 0.pool.ntp.org
Address: 71.170.175.35
Name: 0.pool.ntp.org
Address: 71.238.226.18

(with chuckle) Which leaves the three-part question: Does OpenDNS in fact think it needs to block ntp.org sites, and if so, why isn't it doing so, and why does it (incorrectly) report them as having been blocked as malware?

I'm so confused.

"Does the domain have rotating server/IPs?"

Oh yeah! Even excessive! Your explanations most likely caught it.

Add us to the list, from our MSP dashboard:

pool.ntp.org Malware 5
This malware site was blocked for your protection. You can make an exception for this domain or stop blocking malware sites.

0.pool.ntp.org Malware 17
This malware site was blocked for your protection. You can make an exception for this domain or stop blocking malware sites.

"What a good proposal! Why not follow it?"

If that was aimed at us, then we had already made an exception. I was just sharing that we were seeing the issue too.

No need to be crass.