TCP Foreign Addresses

sml156 said:

I took the liberty to find some info on your last post.
I'm using Windows 10 right now so instead of my usual way to search a list in a text file of multiple IP's for info on IP's I used Win 10 Bash instead of Linux.

Thank you for that. Yes, the LinxTele connections are Kaspersky servers, more than likely Update.

The Google references are normal, as are the Opera, from Oslo.

SoftLayer Technologies Inc. is a Cloud server, Storage provider and I have no idea what they're doing being connected. More research is order.

Again, I thank you for your efforts.

tim

One more tidbit of info see this

Code:

}{
  "ip": "216.58.216.69",
  "hostname": "ord30s21-in-f69.1e100.net",
  "city": "Mountain View",
  "region": "California",
  "country": "US",
  "loc": "37.4192,-122.0574",
  "org": "AS15169 Google Inc.",
  "postal": "94043"
 }{

When you see 1e100 in the host name usually means it's Google

What is 1e100.net?

1e100.net is a Google-owned domain name used to identify the servers in our network.
Following standard industry practice, we make sure each IP address has a corresponding hostname. In October 2009, we started using a single domain name to identify our servers across all Google products, rather than use different product domains such as youtube.com, blogger.com, and google.com. We did this for two reasons: first, to keep things simpler, and second, to proactively improve security by protecting against potential threats such as cross-site scripting attacks.
Most typical Internet users will never see 1e100.net, but we picked a Googley name for it just in case

(1e100 is scientific notation for 1 googol) .

sml156 said:

LOL guess who

Code:

}{
  "ip": "184.172.52.106",
  "hostname": "6a.34.acb8.ip4.static.sl-reverse.com",
  "city": "Houston",
  "region": "Texas",
  "country": "US",
  "loc": "29.7633,-95.3633",
  "org": "AS36351 SoftLayer Technologies Inc.",
  "postal": "77002"
 }{

The Internet Service Provider (ISP) that owns the network address of 184.172.52.106 is ThePlanet.com Internet Services, Inc. and located in Texas within the United States. The IP Address resolves to the DNS record of 6a.34.acb8.ip4.static.sl-reverse.com. Currently there are 2 domain names that utilize this address. The primary domain hosted by this IP is Windows 10 Forums along with 1 other domains.

Source:
https://www.reasoncoresecurity.com/ip-address-184.172.52.106.aspx

LOL!...Touche!... I'm a member at 'tenforums' but don't go there much at all, because I don't have 10- yet!

So, yeah, I know 'sevenforums' and 'tenforums' are virtually the same... so, same address, right?...

I contacted Softlayer, to no avail. So, the parent to 7 and 10 forums uses Softlayer Cloud Servers- they're in Texas. Do you think the other domain may be Windows 7 Forums, or is there no way to tell?...

Well, on a positive note, I come here whenever I don't understand something...and I leave with a bit more knowledge. Maybe I'm just getting paranoid, although I do nothing that should give me reason to be. But then there's the bad guys, too.

I have pretty good security. I run weekly scans, or more if something doesn't look right. I use other tools- AdwareCleaner, JRT, Mbam, and Eset Online Scanner along with TFC. I've started using Sysinternals tools, as well.

Sure appreciate your time and help- Thank you!

tim

Looks like the other server is in the beginning process of a being web server.
IIS Windows Server (184.172.52.106)

Oh, OK... well, everything in my 'netstat' is accounted for then...Yep!

Thanks!...good work!