Is Zemana Spoofing Their Ip Address?

It's not a matter of spoofing, or a sign of any other type of issue. It's simply a matter of how the Zemana website is hosted...

When you do a DNS lookup for the Zemana site, you get this:

Code:

# host zemana.com
zemana.com has address 168.62.20.37

When you do a reverse DNS lookup on the IP address, you get this:

Code:

# ipcalc -h 168.62.20.37
HOSTNAME=useragents.ie

While there are other possible explanations, the most common reason for this is that the IP address in question hosts multiple websites, not just the one you are attempting to reach.

A quick search shows that these other domain names are also hosted on "168.62.20.37"

Code:

# host minemymail.com
minemymail.com has address 168.62.20.37
# host portlandweddinggroup.net
portlandweddinggroup.net has address 168.62.20.37
# host wolcottgroup.com
wolcottgroup.com has address 168.62.20.37

I have a website like this myself. I have a small private forum used for emergency communications with some others. It is hosted at 1and1.com on a shared server with perhaps hundreds of other websites. The DNS lookup from my domain name points to an IP address that is not dedicated only to me, but, is shared across those hundreds of websites. Since the IP address can only reverse to a single name, 1and1 used an internal name like: s########.1and1.info or some such. However, all of those hundreds of websites are unique and have separate content, even though they are hosted at a single IP address.

In any case, this is most likely a matter of shared hosting resources. It could be a deal to get localized content distributed regionally around the world. It could be that Zemana just subscribed to this new hosting agreement for whatever other reason - money, availability, load balancing, etc.