Hy, I installed Online armor firewall. After checking log files i discovered that outgoing UDP connection 127.0.0.1 is resolved as milw0rm.com Message from logs: "Outgoing UDP access allowed to: (milw0rm.com) 127.0.0.1:51989"; Connection isn't from specific process. It's happens with all processes which are listening. Domain name is suspicious for me. I don't have a clue what is that, so maybe someone here can help me. Thanks.
If you want to know what is milw0rm.com domain, read here: http://www.h-online.com/security/news/item/Milw0rm-exploit-portal-ceases-to-operate-Updated-742407.html https://en.wikipedia.org/wiki/Milw0rm As for why is your 127.0.0.1 address seen as milw0rm.com, I have no idea.