Re: [Full-disclosure] svchost.exe try to send http outside

[Mark <fd@xxxxxxxxx>]

howard.lee@xxxxxxxxx wrote:
> The svchost.exe will stop to run when I stop the automatic update.
> 
> But I'm sure the IP tried to connect by the svchost is NOT MS related site.
> 
> 218.213.255.29
> 80.15.249.167
> 
> Regards,
> Howard
> 
Well, the first one, probably not.

inetnum:      218.213.0.0 - 218.213.255.255
netname:      HKNET-HK
descr:        HKNet Company Limited
descr:        15/F, Tower 2, Ever Gain Plaza,
descr:        88 Container Port Road, Kwai Chung, N.T.
country:      HK

But the second address we can't be so sure, I've heard that Microsoft
uses Akamai for Windows Update.

inetnum:      80.15.249.0 - 80.15.249.239
netname:      AKAMAI-FT-US
descr:        Akamai Technologies - US machines connected to FT AS5511

--
Mark

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/