Tracing IP addresses from proxy logs

[Garacesh]

Recently I've been seeing a lot of IP addresses crop up in our Smoothwall top-domains-in-the-past-24-hours-by-bandwidth list and it's starting to irritate me because I don't know what they are or why they're there. Usually they're reasonably low in the list but today we've got one in the #1 spot at nearly 6GB of data.

 

Who.Is shows them all as being RIPE NCC registered. RIPE's WhoIs service doesn't yield much information either.

 

51.254.42.109; OVH SAS, France. Browsing to OVH's homepage gets you a speedtest service. Hostname (ping -a) resolves as ns3625392.ip-51-254-42.eu

5.196.86.80; OVH SAS again. Hostname resolves as ns6664272.ip-5-196-86.eu

185.2.83.46; WorldStream B.V., Netherlands. WorldStream appears to be server hosting with DDoS protection. Hostname resolves as customer.worldstream.nl

185.176.192.22; Histate Global Corp, British Virgin Islands. Histate looks to be another server host. Hostname does not resolve.

185.176.192.26; Histate again. Hostname does not resolve.

 

Kinda unsure of where to go next with this, but I'm pretty suspicious of high amounts of traffic to nameless servers.. Anybody got any ideas?

[andydis]

Without knowing how your smoothwall is setup or further info this is a hard one,

Is your smoothwall just a http proxy or used for routing ?

is it http traffic? https ? if not what port?

if its http traffic can you post the URL logs ?

 

OVH provide VPS servers, popular with minecraft but also popular for hosting nasties.

[Garacesh]

Our Smoothwall box is a HTTP and HTTPS proxy (including D&I), but doesn't host its own DNS, we use our ISP's DNS. I have no idea what kind of traffic it is, I can just see the IP address in the Top domains (24 hours) list. I did try generating a report to find out who has been requesting these domains, but it slowed down web traffic considerably so I've cancelled that and will try again at end of day.

[Chris_Jones]

Block them and see if anything breaks?

[Garacesh]

if its http traffic can you post the URL logs ?

 

OVH provide VPS servers, popular with minecraft but also popular for hosting nasties.

Realised if it's traffic going through our Smoothwall box, I can just watch the realtime logs and see who's requesting it I feel a bit dumb now.

Turns out the 51-109 address was our Site Manager watching Sky News/etc. I've advised against the potentially dubious nature since it's clearly not a Sky owned server and shown him how to legally receive Freeview broadcasts over the network.