FYI Traffic to 104.225.222.168

[LitleBill]

I am troubleshooting connectivity for my IPBX 2027 D .

Anyone is familiar with traffic going to 104.225.222.168 port 443

My PBX is a local machine and behind a firewall,

 

[Atcom]

Looks like a Hivelocity datacenter in Texas but that's about all the info available with an IP lookup.

 

[kenn10]

 $ whois 104.225.222.168

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/resources/registry/whois/tou/
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
#
# Copyright 1997-2023, American Registry for Internet Numbers, Ltd.
#


NetRange:       104.225.216.0 - 104.225.223.255
CIDR:           104.225.216.0/21
NetName:        SN-104-225-216-0-21
NetHandle:      NET-104-225-216-0-1
Parent:         NET104 (NET-104-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS29802, AS54540
Organization:   Strasmore, Inc. (SN-74)
RegDate:        2017-04-28
Updated:        2020-09-10
Comment:        https://www.ssdnodes.com
Comment:        https://www.strasmore.com
Ref:            https://rdap.arin.net/registry/ip/104.225.216.0


OrgName:        Strasmore, Inc.
OrgId:          SN-74
Address:        2522 Chambers Road Suite 100
City:           Tustin
StateProv:      CA
PostalCode:     92780
Country:        US
RegDate:        2013-03-19
Updated:        2023-04-07
Comment:        https://www.ssdnodes.com
Ref:            https://rdap.arin.net/registry/entity/SN-74


OrgAbuseHandle: NONO4-ARIN
OrgAbuseName:   Network Operations, Network Operations
OrgAbusePhone:  +1-949-438-0456
OrgAbuseEmail:  [email protected]
OrgAbuseRef:    https://rdap.arin.net/registry/entity/NONO4-ARIN

OrgNOCHandle: NONO4-ARIN
OrgNOCName:   Network Operations, Network Operations
OrgNOCPhone:  +1-949-438-0456
OrgNOCEmail:  [email protected]
OrgNOCRef:    https://rdap.arin.net/registry/entity/NONO4-ARIN

OrgTechHandle: SHAMS20-ARIN
OrgTechName:   Shams, Kamal
OrgTechPhone:  +1-949-438-0456
OrgTechEmail:  [email protected]
OrgTechRef:    https://rdap.arin.net/registry/entity/SHAMS20-ARIN

RTechHandle: SHAMS20-ARIN
RTechName:   Shams, Kamal
RTechPhone:  +1-949-438-0456
RTechEmail:  [email protected]
RTechRef:    https://rdap.arin.net/registry/entity/SHAMS20-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/resources/registry/whois/tou/
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
#
# Copyright 1997-2023, American Registry for Internet Numbers, Ltd.
#

 

[LitleBill]

Thank you,

is there a reason for the PBX 2027 to send traffic to that datacenter?

 

[wardmundy]

It is one of our servers that stores backups. It may be using it to get your public IP address, but I have no idea. Is this a virtual machine perhaps??

Easy way to find out if it breaks something is to block it in IPtables and see what happens.
Then logout and log back in and see what you see. Test both the Linux CLI and FreePBX GUI.

iptables -A OUTPUT -d 104.225.222.168 -p tcp -m tcp --dport 443 -j DROP

 

[LitleBill]

Thank you for the reply. I blocked the IP

After a couple of hours,I don't see anything broken . Even with REJECT I don't see any entry in the asterisk log