Why does my PC Try to connect to this IP?

In my list of blocked sites, I “manually imported” 24.153.19.207 to 24.153.19.207. These were a holdover from ZA Pro which I was trying to prevent from calling home to NON updating sites. For more information on that there is a 200+ post thread on Wilder’s on that saga.

Now that I have removed ZA Pro and replaced it :■■■■ with CFW I am puzzled why my PC is still attempting to do that in bursts of 4 or 5 attempts 10 minutes apart?

Would someone (:AGL)with win xp sp2 and CFW 2.4 latest and greatest PLEASE put that range into their blocked list and see if it happens on their PC?

If it does happen on another PC them we will know this is NOT unique to my setup and a function of a common piece of software. The most likely are M$ software, or some other piece of common software. Can I assume that CFW does not try to access these? My CFW update continues to work fine.

Thanking you in advance

[attachment deleted by admin]

Hi Escalader

Can we see a CFP Log entry for one of these attempts please. CFPs Log (Activity tab) can exported to an HTML file (right click Log), you can then open the HTML file in your default browser & use a simple Copy ‘n’ Paste to post here. Thanks.

I think the IP you posted is your ISPs… is Rogers Cable Communications your ISP?

Great! This time I can do this for you! It’s and ugly format but you asked! (:KWL)

COMODO Firewall Pro Logs
Date Created: 10:10:38 11-06-2007
Log Scope:: Today Date/Time :2007-06-11 08:53:43Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1271 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:53:43Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1270 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:53:38Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1271 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:53:38Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1270 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:53:33Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1271 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:53:33Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1270 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:43:43Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1191 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:43:43Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1190 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:43:33Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1191 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9Date/Time :2007-06-11 08:43:33Severity :MediumReporter :Network MonitorDescription: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80))Protocol: TCP OutgoingSource: 192.168.1.100:1190 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9
End of The Report

Hmm… :slight_smile: Well I did ask for one entry & you shouldn’t have lost the formatting if you followed my instructions.

Anyway, here’s one I reformatted…

Date Created: 10:10:38 11-06-2007 Log Scope:: Today Date/Time :2007-06-11 08:53:43 Severity :Medium Reporter :Network Monitor Description: Outbound Policy Violation (Access Denied, IP = 24.153.19.207, Port = http(80)) Protocol: TCP OutgoingSource: 192.168.1.100:1271 Destination: 24.153.19.207:http(80) TCP Flags: SYN Reason: Network Control Rule ID = 9

So, is this your ISP (see above)?

Yes, it is my isp.

The site is connected with Akamai. So does it have to do with providing Web caching for the ISP?

Official name: a24-153-19-207.deploy.akamaitechnologies.com
IP address: 24.153.19.207

http://whois.domaintools.com/24.153.19.207

Thanks!

Well that is both interesting and :-[ at the same time. ( ps I thought I did follow the instructions!) oh well it’s an imperfect world full of imperfect people like me! I did current look and it confirms the 4 ISP addresses I’m blocking lies in the range of my ISP ip’s. Here is the data.

I will ask them what ip’s they actually need, since my only symptom is the log entry. They seem to have 4 servers.

HOIS results for 24.153.19.207
Generated by www.DNSstuff.com

Location: Canada [City: Etobicoke, Ontario]

Using 3 day old cached answer (or, you can get fresh results).
Displaying E-mail address (use sparingly – this will make it more likely that you will trigger our rate limiting system).

OrgName: Rogers Cable Communications Inc.
OrgID: RCC-104
Address: One Mount Pleasant
City: Toronto
StateProv: ON
PostalCode: M4Y-2Y5
Country: CA

NetRange: 24.153.0.0 - 24.153.31.255
CIDR: 24.153.0.0/19
NetName: ROGERS-CAB-104
NetHandle: NET-24-153-0-0-1
Parent: NET-24-0-0-0-0
NetType: Direct Assignment
NameServer: NS2.YM.RNC.NET.CABLE.ROGERS.COM
NameServer: NS2.WLFDLE.RNC.NET.CABLE.ROGERS.COM
NameServer: NS3.YM.RNC.NET.CABLE.ROGERS.COM
NameServer: NS3.WLFDLE.RNC.NET.CABLE.ROGERS.COM
Comment:
RegDate:
Updated: 2006-12-05

OrgTechHandle: IPMAN-ARIN
OrgTechName: IP MANAGE
OrgTechPhone: +1-416-935-4729
OrgTechEmail: ipmanage@rogers.wave.ca

ARIN WHOIS database, last updated 2007-06-07 19:10

Enter ? for additional hints on searching ARIN’s WHOIS database.

OK. your ISP own it and, as Ravenheart pointed out, it has Akamai in its resolve name. Problem: Akamai is used by lots of software as well, including ZA/ZAP. Its even used by MS. Since its an Outbound block can you identify the application that generated it? It could be an ISP-cache as Ravenheart said. Probably the quickest way to resolve is to ask your ISP what it is.

Kail, I’m getting confused again!

When you ask me for an application I think, hmm must mean FF or IE or word or some such program? Then I look at my CFW logs and can’t find any references to what program was actively involved so what to do?

For the learner ( that’s me) what is Akamai is it a company? a piece of sofware, an ISP. These 4 ip’s I had were connected to ZA and M$ un requested non- updating call homes blocked in ZA Pro, they were blocked by me and thus they arrived on my list here in CFW!

Since there is doubt, until I know why/if my isp uses them I’ll block them again! All it seems to do is create log entries I function on the PC fine. I hate these mystery outbound issues, there has to be a better way than plugging the ■■■■ one ip at a time!

Earlier research I did on attempted outbounds found a set of xx.AKAMAI.com’s.
xx='d YG, YH,YE,YF, YC and YD. Some of the ip addresses for these were duplicates, YE was same as YF as an example.

For now I’m assuming these are info gathering sites, for ZA and for M$ possibly SpySweeper so I have them all blocked. All my updates continue to work including the most recent XP update.
So blocking them has no ill effect on my setup.

Since trust of unknown sites is not wise IMHO, I suggest we all should block them.

This site you have continues in my log every day so my isp is using it. No doubt through FF. I leave it blocked and continue to use all functions on my PC, so for now I’ll leave it blocked as well.

If anybody wishes to defend these ip’s proof would be needed as to why. (:NRD)