I recently happened to see that cmdagent was connecting to 144.99.93.175, which seems to be related to the USAISC, does anyone know why did cmdagent attempt that connection? (sadly i cant give more details since due to a powercut my logger shutdown without saving its log so i cant state what port it was using but i’ll try and guess it was http). I’m not even american im from europe O_o
Actually im rather scared of this, totally unknown and unrelated to me ip so any help would be greatly appreciated.
sorry i can’t say that for sure, i havent checked the port (dumb of me) i only written down the ip for a later whois from my other pc, i can imagine 80 because most were, but as i said 1 i didnt check 2 my logger went down
Pretty spooky stuff. All indications I can find point to USAISC :o The Carlisle in the whois refers to carlisle-www.army. mil, which is the US Army War College. It also refers to the Carlisle Barracks, which is a home of the USAISC.
You can block cmdagent by deleting the existing rule and creating another with a block out everywhere. However, doing so will remove some functionality, such as cloud scanning and updates.
it was very very kind bothering yourself that much for me, thanks i appreciate it very much.
It kinda answers the question but i still would like to get why that ip, i mean we all seen the whois its not COMODO GROUP so why was it going there? If its possible id like to know still thanks to both for your time and your precious help
ps:
it doesnt change O_o i hope you’ll forgive my paranoia but lol i pinged it like 40 times its soon going to pass for a DoS but stil never changed to that one
I traded a couple of pm’s about this with umesh. The IP address belongs to Cachefly that is hosting the CIS updates for Comodo.
About the inconclusive whois information umesh said he would notify Cachefly that the IP range is not showing up as belonging to them. The IP range has probably been sold a couple of times and the information by Arin is not up to date.
Sorry if i keep bothering but im a very paranoid person.
I recently found log entries of 1 month before and after this incident and this IP was never listed actually you said you talked to “umesh” about this may i have some public official explanation from him? (unless you re in the comodo’s staff).
I’m getting really frustrated right now, if there is something that cant be discussed publicly i invite you to send me a pm. (i actually dont mind if i find my inbox with “comodo has a governative backdoor in it” even my old modem had one and the only way i got rid of it was when it broken on me and they wouldnt replace it so its np aslong as its documented, just saying, im NOT claiming comodo has such things)
