0

Yesterday I noted in my router logs that my wife's laptop accessed crl.comodoca.com. She was not using the machine at the time. A quick google search found three sites claiming this was an indication of a trojan, but all of them recommended using spyhunter for removal. I looked up spyhunter and it looked like spyhunter itself appears to be a scam.

I ran scans on her laptop with windows defender, Malwarebytes and the trend micro rescue disk. Nothing was found.

I looked at the logs this morning and saw that my main PC accessed the site while we were asleep. So this morning I blocked the site with openDNS, in my router firewall and added an outbound rule to my main machine's defender firewall to block the IP address (151.139.128.14) I added this rule to Defender in hopes that I can find the program or service connecting to the site.

Further google search shows that in 2016, Bitdefender was blocking the site but it seems from most posts this might have been a false positive. No one back then could find offending malware. It sounds like svchost was connecting to it.

Furthermore, some research indicates that this may be a legitimate certificate revocation list (crl) server, which I would not want to block.

I have learned from the comments below that it is important to NOT block this site, but the original question is off-topic. So I changed the question.

5
  • @schroeder: actually not; Comodo sold the CA part of its business in 2017 to a private equity firm, who in 2020 sold to another, and in the process it was rebranded Sectigo although so far they continue to use the previous domainnames as well as new sectigo ones. It does remain legitimate. Nov 6 at 23:15
  • @dave_thompson_085 actually, yes. comodoca.com still lists Comodo Group, Inc. as the owner. So, yes, actually, if you look, that is what you will find ... But, yes, the brand is Sectigo ...
    – schroeder
    Nov 7 at 0:48
  • 151.139.128.14 is an IP address owned by a popular CDN; blocking it will cause problems with crl.comodoca.com, which is bad enough, but it may also be used by other websites. Nov 7 at 7:34
  • @A.Goldstein that would be a better question, but I think that we have one just like that from a few years ago. Edit your question and I'll reopen and see if there is a historical duplicate
    – schroeder
    Nov 7 at 11:28
  • @schroeder: where does it say that? Both http://comodoca.com https://comodoca.com 301 to https://www.comodoca.com which says at the top "Comodo Certificate Authority powered by Sectigo", does not say Comodo Group anywhere, and at the bottom says "© 2021 Sectigo Limited. ...." and links to exactly the "about" page I already referenced which says "Comodo CA is a subsidiary of Sectigo (formerly Comodo CA)". Most of the legal/policy links are to sectigo, and if you look on https://www.comodo.com/ under Products there is no mention at all of certificate(s). Nov 8 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.