Is this a fake CNN website?

I pinged "www.todaycnn.com" and got 68.142.212.40 for an ip address. A whois on that ip address turned up Inktomi as the owner, so I figured the site's actually hosted with them. It appears though, from what msmittens and I both turned up, that melbourneit.com handles the private registration.

Seeing as how Inktomi does the actual hosting, it might be best to contact them at this email address I turned up (thank you, Sam Spade!):

[email protected]

Try that one. MelbourneIT may have one too but I haven't turned it up yet.

Hhhmm interesting, my Trend Micro didn't pick anything up on the exe...it's a pop up for this site: Totalregistryfixer

Looks new, nothing on google for this yet as malware, or at least I couldn't find it, may want to break the links to the exe.


Had to do a restore to get rid of it...fun and games.... ;)

Edit:
©opy®ight

Quote:

---

Yeah it fake, when you click on live its an .mpg.exe file. i scanned it and its a virus allright....

---

What did your AV pick up, and what AV are you using?

Yeah, dalek, I rebooted into Ubuntu to download the .exe but couldn't do an online scan because I have Java disabled. Then I wondered, "Why bother?"

I hate taking any chances anymore...

edit -- That's interesting. I just pinged www.todaycnn.com again and got a slightly different ip address (still belongs to Inktomi though): 68.142.212.46

Then again, and this one (!): 68.142.212.50

dalek:

AVG, just said virus found and gave me options to heal, delete etc...i just deleted it....

Quote:

---

Originally posted here by ©opy®ight
dalek:

AVG, just said virus found and gave me options to heal, delete etc...i just deleted it....

---

Sh*t I have a corporate version of Trend Micro Internet 2006 with all the bells and whistles and it missed this and your AVG got it....I'm uh...impressed.... :(

Ok, I emailed this address bc gave me: [email protected]

Interesting, I went ahead and downloaded the .exe. to "My Documents" and Panda's online scan turned up nothing. I've encrypted it and will run an AV against it the next week or two.

And now www.todaycnn.com's ip address is 68.142.212.44, then 68.142.212.43

These guys must have quite the operation (several servers?).

edit -- now it's 68.142.212.47

I googled the IP 68.142.212.43 and got http://castlecops.com/t157606-PIRT_2...42_212_43.html

Which referenced this:

Report for AS14780
Name

INKTOMI-LAWSON - Inktomi Corporation

Whois Entry


IANA has recorded AS14780 as originally allocated by ARIN

RIRs have AS14780 whois information provided by ARIN

-No Whois Entry Obtained-


AS Adjancency Report

In the context of this report "Upstream" indicates that there is an adjacent AS that lines between the BGP table collection point (in this case at AS4637) as the specified AS. Similarly, "Downstream" referes to an adjacent AS that lies beyond the specified AS. This upstream / downstream categorisation is strictly a description relative topology, and should not be confused with provider / customer / peer inter-AS relationships.

14780 INKTOMI-LAWSON - Inktomi Corporation Adjacency: 1 Upstream: 1 Downstream: 0
Upstream Adjacent AS list
AS10310 YAHOO-1 - Yahoo!

Announced Prefixes

Rank AS Type Originate Addr Space (pfx) Transit Addr space (pfx) Description
3689 AS14780 ORIGIN Originate: 28928 /17.18 Transit: 0 /0.00 INKTOMI-LAWSON - Inktomi Corporation

Aggregation Suggestions

This report does not take into account conditions local to each origin AS in terms of policy or traffic engineering requirements, so this is an approximate guideline as to aggregation possibilities.

Rank AS AS Name Current Wthdw Aggte Annce Redctn %
9491 AS14780 INKTOMI-LAWSON - Inktomi Corporation 5 0 0 5 0 0.00%


AS14780: INKTOMI-LAWSON - Inktomi Corporation
Prefix (AS Path) Aggregation Action
4.79.181.0/24 4637 10310 14780
66.163.176.0/21 4637 10310 14780
68.142.192.0/19 4637 10310 14780
209.191.64.0/18 4637 10310 14780
216.252.96.0/21 4637 10310 14780

Advertisements that are fragments of the original RIR allocation (more specifics) originated by this AS.

AS14780 4 More Specifics 5 Total Advertisements INKTOMI-LAWSON - Inktomi Corporation
4.79.181.0/24 (4.0.0.0/8)
66.163.176.0/21 (66.163.160.0/19)
68.142.192.0/19 (68.142.192.0/18)

http://www.cidr-report.org/cgi-bin/as-report?as=14780


Another email for reporting abuse [email protected]

Now it's 68.142.212.48

Inktomi is one of those mass server sites. They project sites out. The question is: why would they project this one out? I'd file the complaint with the following:

Inktomi
Yahoo
CNN