A DNS query for this domain (messager.xicp.net) was classified and detected as "Trojan.Generic.DNS" by the FireEye NX in our network.
So, I used both VirusTotal and abuseibdb sites to check this domain. It seems it's mapped to 127.0.0.1 (localhost) and when I ping this domain it pings my localhost IP. Could you explain this behavior?
I tried using viewDNS to trace route and I got this output:
traceroute to messager.xicp.net (127.0.0.1), 30 hops max, 60 byte packets 1 obfuscated.internal.network.com (0.0.0.0) 0.000 ms 0.000 ms 0.000 ms 2 obfuscated.internal.network.com (0.0.0.0) 1.000 ms 1.000 ms 1.000 m
Could you please explain this behavior, why it's mapped to 127.0.0.1 (It wasn't like this according to the results from VirusTotal as it was mapped to this IP 174.128.255.245 on 2018-04-11)