Rubicon Project

[PhilipC]

Hi there,

 

Long time lurker, first time poster here.

 

Recently I've noticed some large downloads coming from rubiconproject.com. At first glance rubiconproject seems harmless enough (it's an advertisement buyer and seller) but the size of these downloads is around 4gb a time. Since Wednesday we've had a total of 32gb incoming.

 

Basically my question is; Does anyone have any idea what these downloads are? Anyone know if it will cause any issues if I block the traffic?

 

Just curious. Thanks in advance. You guys are great

 

Phil

[TechMonkey]

Are you able to work out if it is the same user, same devices or even which devices it is going to? If it is not your domain machines, so a mobile device on your WiFi, I would say an app is downloading ads or game files and you are seeing the proliferation of it around the students.

 

The scary alternative is that their ad network has been turned to nefarious means and payloads are being downloaded. You could try the scream test. Block and see who screams?

[PhilipC]

I've just been going through the logs and I can see the majority is a single user but there are other users also getting them. Non of the connections are over the wifi. I'm just looking into if the downloads are to the same device, although i'm almost certain they are different devices as one of the users is a teacher and would only use her machine or a staff room machine and another user (majority user) is a 6th form student who would not have access to either of her machines.

 

I think the idea of it being an app downloading ads is a great one but doesnt add up in our case as the downloads are going to workstations that are locked down.

 

I'm going to try a report that spans a much longer time period and see if I can spot any kind of pattern on who is receiving these and when.

 

I've blocked them for now, so we'll see if the "scream test" yields any results.

[TechMonkey]

Does the traffic before or after give any clue? I can only think maybe it is acting as a CDN and delivering a video for a website or streaming something.

 

Good luck and I'd be interested if you find out.

[PhilipC]

It turns out it was a known issue with our firewall and the software we use for reporting (Sonicwall and fastvue). We noticed some discrepancies between the actual logs on the firewall and the reporting software so we contacted fastvue tech support and as soon as we started explaining what we were seeing they knew exactly what it was. Basically fastvue reports that the downloads have happened/are happening when the sonicwall is actually blocking the traffic. They're currently working on a patch.

 

So yeah, false alarm! Thanks again for the ideas. Just thought I'd update you on this.

 

Phil