Hi, we've been seeing the domain wireshark.net being classified Low Risk by the some Firewals.
We are seeing some devices accessing dl1.wioreshark.net, I imagine should be for updates.
Wonder if you can share some light about this activity, is this domain something you own, something that is on the code that needs to be contacted by the application?
To my knowledge, no. Neither wireshark.net nor dl1.wioreshark.netare affiliated with Wireshark. The only legitimate download servers I'm aware of are listed at https://www.wireshark.org/download.ht..., and they currently only include the following:
Personally, unless you're aware of some other legitimate reason for those devices contacting those sites - and judging by your question here, that doesn't appear to be the case - then I'd block access to them.
EDIT: Well, according to a whois lookup, it does appear that the registrant organization is the Wireshark Foundation after all:
Registrant Organization: Wireshark Foundation, Inc.
Still, I can't think of a valid reason why any device should be attempting to contact that domain instead of wireshark.org or any of those listed above. (And I assume dl1.wioreshark.net was a typo and you meant dl1.wireshark.net ?)
We (the Wireshark Foundation) do own wireshark.net, along with a few other Wireshark-related domains such as wireshark.ninja and wireshark.foundation. dl1.wireshark.net points to the same addresses as 1.na.dl.wireshark.org, but as Chris notes, clients should be using the wireshark.org address and not wireshark.net.
Comments