Topic: is "whois" only feature or bug or any special ??

[SPEEDNIC]

Hi,

right now I have seen on my ssh-shell that ScriptPulse will send "whois" request within a shell command like this (2 examples) :

Code: [Select]

10111 ?        S      0:00 sh -c cd '/traderdirectory' ; whois 74.222.4.117                                           
10112 ?        S      0:00 whois 74.222.4.117                                                                                             
20466 ?        S      0:00 sh -c cd '/traderdirectory' ; whois 222.232.53.196                                         
20467 ?        S      0:00 whois 222.232.53.196                                                                                           
24614 ?        S      0:00 sh -c cd '/traderdirectory' ; whois 121.141.66.110                                         
24615 ?        S      0:00 whois 121.141.66.110                                                                                           

Strange is that I have not clicked on a IP address through the admin panel to open the popup with the whois info It don't seems that it will be done for all IP addresses (would be explode the tcp requests) but why will ScriptPulse do this kind of requests for self ??

thx

[Kildoozer]

Hello.
TradePulse doesn't run 'whois' at all. Nowhere.
The only 'nslookup' using for detecting name servers, during the deleting domains inside admin area.

[SPEEDNIC]

Hi, hmm ... I though it comes from ScriptPulse because I have seen that if you click on a admin interface which opens a "whois result" in a window. But now I know that it wasn't - it was from the new AntiCheat script from Protect-X which will start the whois requests