Why does Open-Shell connect to cl-glcb90725.gdn.co?

[Alan-Cyber-Best]

Hello! I checked Open-Shell 4.4.201 on VirusTotal. The executable has 0/71 detections, but one of the contacted domains (cl-glcb90725.gdn.co) is flagged by 1/89 security vendors.

Could you please clarify why Open-Shell connects to this domain? Is this connection necessary for the program to function, and is there a way to disable it?

I understand that a single detection does not necessarily indicate malware, but I would appreciate an explanation of this network activity.
<img width="2559" height="1545" alt="Screenshot 2026-09-23 130952" src="h

ttps://github.com/user-attachments/assets/919fec49-4007-4217-8dda-c18dd159671a" />

[Alan-Cyber-Best]

[ge0rdi]

From VirusTotal analysis it is not clear what process did such connection (whether it even was Open-Shell or anything related to it).

Since this was Open-Shell installer analyzed, I'd assume the product was not installed. So this analysis is related to installer itself.
Installer (exe stub) just drops MSI file and runs it. Neither installer stub nor MSI is supposed to do any network communication.

My guess would be that this is simply some issue at VirusTotal side.

[Alan-Cyber-Best]

Could you please share the network log from your analysis?

I’d like to see whether the Open-Shell installer or the MSI file actually made any network connections, especially to cl-glcb907925.gdn.co.

If possible, please include the destination IP addresses, timestamps, and the process responsible for each connection.

[ge0rdi]

You should ask VirusTotal for that.
As their analysis claims Open-Shell installer is doing any such connections.

[ale5000-git]

From my experience virustotal "include" also the domains contacted by their own tools.
For example if they use another tool to execute the executable being scanned even the requests done by their own tools are unfortunately included in the report.