I found following in my Console on MBA 10.13
Stealth Mode connection attempt to UDP 192.168.0.12:52734 from 126.96.36.199:53 Stealth Mode connection attempt to UDP 192.168.0.12:57880 from 188.8.131.52:53 Stealth Mode connection attempt to UDP 192.168.0.12:51017 from 184.108.40.206:53
I know the 220.127.116.11 is Google DNS server that I use.
The 192.168.0.12 is my en0 IP.
The Host file looks like this
# localhost is used to configure the loopback interface # when the system is booting. Do not change this entry. 127.0.0.1 localhost 255.255.255.255 broadcasthost ::1 localhost fe80::1%lo0 localhost
I also found one of the IP 192.168.0.12:52734 actualy leads to a weird page. http://foro.euskaltel.com/Thread-Test-de-Velocidad-Internet?page=88