What's up with the Zidoo pinging the domain "alog.umeng.com?" A google of this is not encouraging..

Yea, so I saw that the Zidoo pings the below domains:

- alog.umeng.com
- alog.umengcloud.com

Does anyone know what these are? They'r clearly Chinese domains but I am not sure what the Zidoo is using it for. A google search shows that this domain was apparently responsible for some SMS malware in Asia a little while back. I can't post links here but you can just google "alog.umeng.com malware" and you'll see what I mean. I'm a little sketched out so any information would be helpful..

It looks like umeng.com could be owned by Alibaba, which would just mean it's just an analytics/telemetry domain used by the developers. I'm just curious since I monitor all traffic that goes in and out of my network. I can just block these domains to be safe but was wondering if anyone had any info.

 

Also wondering about the domain: whois.pconline.com.cn

 

Which player are you talking about thats doing this? Also, is the software as new out of the box??

 

Just shark it and you'll soon see there's nothing untoward going on.

 

What do you mean shark it? And yea, sorry, my intent wasn't to claim that there's anything shady going on. I just like to analyze all domains that my devices try to contact.

 

Software new out of the box. Only non-stock software I installed was ZDMC. I think these domains are being contacted by the Zidoo itself, not HT4.0 or anything but I'm not 100% sure.

 

@Jimbo Randy - just research. Try here: - https://www.wireshark.org/

 

Thanks man. I'll look into it. From what I can find, the umeng domains are probably just like analytics. Not sure what the whois domain is for. Could be for automatic time setting, or the weather app. I'll just block all of them. I only need the metadata scraper domains and the update domain to work. The rest can be blocked.

 

@Jimbo Randy - if Mark says there's nothing untoward going on, you can bet your bottom dollar nothing is.

 

Wireshark - you can see everything the box is doing either on the WAN or LAN.

 

Thank you sir.

 

You're very welcome.