intelnet.net.gt domain in the hosts file

[dbau]

I was going about uninstalling xampp as I need to isolate some issues, and I noticed this in my hosts file:

127.0.0.1 ud102-10.168.192.intelnet.net.gt # added by Apache Friends XAMPP
### Begin DesktopServer - do not edit this and proceeding lines ###
### End DesktopServer - do not edit this and preceeding lines ###
127.0.0.1 ud103-10.168.192.intelnet.net.gt # added by Apache Friends XAMPP
127.0.0.1 ud134-10.168.192.intelnet.net.gt # added by Apache Friends XAMPP
#Added by XAMPP Control

I do not have experience in the ins and outs of Apache, but I fould it suspicious that XAMPP was linking a localhost-looking domain to a URL located in Guatemala, that resolves to the Guatemalan telecom Claro. Why on earth is my AMP stack linking to a Guatemalan telecom?

Can anybody provide some clarity as to what this domain is?

Thanks all!

D

[JJ_Tagy]

That doesn't come stock with XAMPP... looks like you were compromised. "Added by XAMPP Control" is a lie meant to deceive.

[Nobbie]

Your hosts file has been hacked.

[dbau]

Yikes. Thanks guys. If I had used DesktopServer in Guatemala, and had accessed an external URL from DesktopServer (using XAMPP) would it have automatically created these entries? Or is this totally fraudulent?

[Nobbie]

If I had used DesktopServer in Guatemala, and had accessed an external URL from DesktopServer (using XAMPP) would it have automatically created these entries? Or is this totally fraudulent?

I dont know. It is possible, that any software installation may do so and add some lines to the hosts file. This is (for example) often used for cracked Adobe Products, the crack does not only install a copy of an unpaid Photoshop or similar, it also adds a line to the hosts file, which connects 127.0.0.1 to adobe.com (in order to avoid, that the stolen software connects to the Adobe Server for registration purpose). But i either dont know, what intelnet.net.gt means and i also do not understand, why "Xampp" is mentioned in the comment. Its really strange and you *should* know, what you did install and run on your PC.

Maybe you have been asked by a software and you simply do not remember (or you did not understand the question). Difficult to say.

[dbau]

Well I never implicitly gave ServerPress any kind of permission to do so, but perhaps it is part of the functionality. Happily using MAMP now. I've emailed them and will see what they say, in any case. Thanks all, appreciate it!