My firewall started flagging for some questionable downloads from a direct IP address. I started wireshark and saw some concerning traffic to it. The IP address is 68.106.66.77. It's a cox owned ip that I'm being redirected to for an update. This looks really suspicious so just wondering if anyone has any insight? I've blocked that IP address in my firewall for now until I feel ok about it. Attached is a quick screenshot of what the packet capture looks like (blocked out some potentially unique info). I guess it might be legitimate (like a ISP content box for updates) but if so, seems pretty sloppy to redirect to a direct IP address. And suspicious in general. So anyone seen this before or know about it?
↧