Jump to content

Is this malware?

Recommended Posts

Hello. I have some strange dns queries going on.

Open dns is saying some thing is requesting domains like this:







a "dig" on e5.sk shows:

dig +trace e5.sk                     

; <<>> DiG 9.9.2-P2 <<>> +trace e5.sk
;; global options: +cmd
.                       518282  IN      NS      g.root-servers.net.
.                       518282  IN      NS      d.root-servers.net.
.                       518282  IN      NS      j.root-servers.net.
.                       518282  IN      NS      a.root-servers.net.
.                       518282  IN      NS      k.root-servers.net.
.                       518282  IN      NS      m.root-servers.net.
.                       518282  IN      NS      c.root-servers.net.
.                       518282  IN      NS      e.root-servers.net.
.                       518282  IN      NS      b.root-servers.net.
.                       518282  IN      NS      h.root-servers.net.
.                       518282  IN      NS      i.root-servers.net.
.                       518282  IN      NS      l.root-servers.net.
.                       518282  IN      NS      f.root-servers.net.
;; Received 239 bytes from in 40 ms

sk.                     172800  IN      NS      a.tld.sk.
sk.                     172800  IN      NS      c.tld.sk.
sk.                     172800  IN      NS      ns.eunet.sk.
sk.                     172800  IN      NS      ns.sk-nic.sk.
sk.                     172800  IN      NS      ns1.sk-nic.sk.
sk.                     172800  IN      NS      ns3.sk-nic.sk.
sk.                     172800  IN      NS      sns-pb.isc.org.
sk.                     86400   IN      NSEC    sl. NS RRSIG NSEC
sk.                     86400   IN      RRSIG   NSEC 8 1 86400 20140317000000 20140309230000 33655 . CrEdW8psKI1+7QCNxofwNftW7+v7Z0RcEn9ob0l65Nrex04B1XNpWkOT VijVjnKY4QX4HtfjhVe4FzeM4e78ycyXdUWvuEMRXHsDPFPJ/qGORr/w 5YselmVHpr4fAqD3T5Buf67IKUFaQCPsgbR+G2sx0qshrYD3aoQEzOaX 55g=
;; Received 560 bytes from in 1038 ms

e5.sk.                  86400   IN      NS      h5-f5lb01-lsnr02-s.eset.com.
e5.sk.                  86400   IN      NS      h3-f5lb01-lsnr01-s.eset.com.
e5.sk.                  86400   IN      NS
;; Received 141 bytes from in 938 ms

e5.sk.                  900     IN      SOA hostmaster. 2011111173 10800 3600 604800 900
;; Received 109 bytes from in 444 ms

I am asking about this here only because e5.sk seems to be eset....is this my anti virus doing something it should not be?


Any thoughts on this?

Edited by DavidP
Link to comment
Share on other sites

I don't understand why parental controls would have anything to do with these domain requests. Also, if its not on by default, its not on because I never turned on parental controls.

Link to comment
Share on other sites

With parental control, you can control the network traffic of your kids, and filter out certain sites.

What better way to block sites then by dns servers or requests not turning over the address of the site ?


I imagine this is what Marcos was referring to when he mentioned Parental controls.

Link to comment
Share on other sites

  • 3 weeks later...
Hi there


I'm using only an endpoint and Business edition of the software. What component is responsible for this kind of DNS queries inside of Business edition?


Thank you.

Link to comment
Share on other sites

  • 2 years later...


I have the same thing on my DNS log.

I don't have Parental Control enables!

What can it be?





Link to comment
Share on other sites

  • ESET Moderators


The e5.sk domain is used by our product to perform URL checks. To speed the process up and make it more lightweight, it runs on the DNS protocol.

Thus, the entries are OK, they are not traces of malware.


Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...