Malware Analysis Possible Suspicious activity ?

[mkaz]

I was taking a look at this thread , I ran netstats to check to see if there any suspicious network activity. I do not know if I being paranoid about keylogging/rat/ or is it something profoundly troubling based on the report on abuseipdb.com. I do know this has to co relate with program its running or abnormal activities. However, I do not see any sign of it. I would like to make sure though.



is this something to be worried about, since i do not understand where does 72.21.91.200 time wait . come from,

screenshot below, it was in firefox

On abuseipdb.com, it shows the report on this being related to spam , though it different num on end, however where does verizon come to pic, How do I figure what site or server. I want to be certain if there any any suspicious activity on my laptop.
Also,this


As myself, I have managed to keep myself updated and secure and clean station. Most important use common sense
Windows 10 ,version 1803
Security
Window firewall
Kaspersky free
Malwarebyte
Spyshelter

Sandboxie
VPN
Firefox Extension
Ublock | Privacy Badger | Decentraleyes | cookieautodelete

 

[Eddie Morra]

If Firefox.exe was the culprit, you were probably just accessing a web-page which reached out to it for one reason or another in the background.

 

[mkaz]

Thanks for your reply, I appreciate it. I do not know what website it is to pinpoint, since I definitely do not have any malicious website running. What can I do at this point. fyi, I am using sandboxie

 

[Eddie Morra]

Can you send me your HOSTS file in a PM?

SystemDrive:\Windows\System32\drivers\etc\hosts

I was taking a proper look into what you shared and there's recent reports that this IP is being pushed via traffic redirection of the HOSTS file by malware... and that would actually be related to the web-browser (e.g. Firefox) because such will have to pass through the hosts file naturally (Windows handles that).

This doesn't mean you're infected, the reports are unconfirmed allegations.

EDIT:
1. Post above mine which I was replying to has disappeared.
2. Fixed path.

 

[ForgottenSeer 69673]

SystemDrive:\Windows\System32\etc\hosts

Is this folder on Win 10 home? I don't have that folder on my system. No etc folder

 

[Eddie Morra]

Sorry, I wrote the wrong path.

It should be: SystemDrive:\Windows\System32\drivers\etc\hosts

 

[ForgottenSeer 69673]

Sorry, I wrote the wrong path.

It should be: SystemDrive:\Windows\System32\drivers\etc\hosts

Yes I found it before reading your new post. I hardly ever check that. Besides the usual 127 IP Add, I have two others.