I lauched ping windowsupdate.daemon.sh it is resolving to a public IP. PING windowsupdate.daemon.sh (218.18.149.138) 56(84) bytes of data.
The whois: inetnum: 218.13.0.0 - 218.18.255.255 netname: CHINANET-GD descr: CHINANET Guangdong province network descr: Data Communication Division descr: China Telecom country: CN http://www.vsantivirus.com/mofei-c.htm At this web site are showing something different but the virus is using the same DNS Resolution. Do you see anything else? Could you tell me more about your tests? Regards, El mar, 17-03-2009 a las 17:52 +0900, 김무성 escribió: > Hello. > > > > I’m testing malware. > > It DNS query xxxxxxxxxxx.ods.org and xxxxxxxxx.daemon.sh > > And response is 255.255.255.255 > > > > What is 255.255.255.255? > > Can DNS hosting company set that specific DNS name set to > 255.255.255.255? > > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
