Norton DNS

So Malwarebytes periodically stops potentially bad websites from opening... like this one:

http://www.tvsubtitles.net/tvshow-55-1.html

(Don't know if this site is really dangerous or not - but that's not the point)

When MBAM blocks it, the MBAM notification pops up in the lower right corner of the monitor.

I periodically get websites blocked by MBAM.

Why do I never (and I mean never) get anything blocked by Norton DNS?

Can anybody verify that Norton DNS is actively adding sites to its blacklist?

Does this thing really do anything?

Is anybody in there?

Just wonder'in...

 

Even though the following is not a dangerous site, (it offers malware "test" downloads much like Eicar does), Norton blocks the whole site though Malwarebytes doesn't:

http://www.spycar.org/Spycar.html

So it does at least block some things though I rarely come across those sites.

 

FYI
Blocked by TrafficLight extension (in Firefox).
Not blocked by DynDNS Internet Guide.

 

Thanks Blues.

Pretty sure that's the first time I've ever seen that screen -- that is the screen that shows that Norton DNS blocked something. And I've had Norton DNS for half a year. And I'm an unsafe surfer.

Does Comodo still have a DNS program?

I guess it's time to look around a little..

 

Currently the latest Comodo DNS is in beta, worth trialling.
http://dev.recursive.dns.com/

 

Actually, it is very much the point.

Norton DNS will block domain names. MBAM will block IPs, that I know of. Many domain names share the same IP. If MBAM blocks one IP linked to a bad domain, any good domain hosted on the same IP will be blocked as well.

That's the problem with blocking IPs - you block the bad and good.

You can test Norton DNS by checking domains rated red in safeweb.norton.com

The domain you pointed translates to the IP 93.170.48.67 http://www.ipvoid.com/scan/93.170.48.67

It's currently flagged by one list.

http://www.robtex.com/ip/93.170.48.67.html

That IP is shared by other hosts.

Those hosts may or may not be related to each other. I really didn't bother to look. But, I'm just trying to show that if one of those hosts is malicious and MBAM blocks by IP, then it will for sure block any other good domain that shares that same IP.

 

That's because the amounts of MBAM false positives in that area is staggering.

 

testing around today with 22x 0-day malware links at different security setups.

With...
Avast Free AV (Webshield)
MBAM Pro
CIS Firewall & D+
.. NortonDNS still blocked some links that the others didn't.

 

I've got similar results before, except with TrafficLight (and sometimes WOT) added in the mix.