I am missing something

Posted by Traditional-Tech23@reddit | sysadmin | View on Reddit | 5 comments

We get firewall alerts for some domains names which are blocked as suspicious but when I do some looking into theses domains. All they are http 301 redirects to google Is this an advertising scam website

Reply to Post

5 Comments

[-]

mike9874@reddit

For the exact same page it does a redirect, or just the root? They could be hosting a redirect on the root and malware on another page or subdomain

[-]

rynoxmj@reddit

Ya this was exactly my thought as well.

[-]

Traditional-Tech23@reddit (OP)

it has a few hits on virustotal so it was suspicious at one time.

[-]

StefanMcL-Pulseway2@reddit

They could be false positives because of things like shared hosting environments or previous misuse of the domain - if it is malicious it could also be a cloaking technique so that they don't get caught by security scanners. There are schemes where redirects are used to artificially inflate traffic or manipulate search engine rankings. so your right to be way of that too. You could use tools like the Wayback Machine or domain history checkers to see what content used to be hosted on the domain.

[-]

SensitiveFirefly@reddit

Parked domains to be used later on.