1

I have several applications on my computer which are attempting to connect to a small hand-full of IPs over port 80(http). This seems suspect to me and I'm not sure how to proceed. Currently I am using Little Snitch to block the IPs however this is causing some things to not work.

IPs in question:

  1. 151.205.0.101
  2. 151.205.0.103
  3. 151.205.0.105
  4. 151.205.0.107

Looking up these IPs on Who.is reveals they are owned MCI Communications Services, Inc. d/b/a Verizon Business (MCICS)

The applications I have seen trying to connect to these IPs

  • Private Internet Access, Although it has since stopped since I updated it to the latest version.
  • softwareupdated
  • nsurlsessiond
  • storedownloadd
  • Google Chrome
  • Spotify
  • ksfetch
  • vmnet-natd
  • ScreenSaverEngine

I believe I have seen other applications in the past attempt to connect to these IPs, however, the ones above are attempting to as of me writing this.

What could be causing all of these seemingly unrelated applications to try to connect to these IPs?

  • 2
    Is Verizon your ISP, by chance? – IconDaemon Dec 4 '18 at 14:37
  • 1
    Could it be that the port is 53? – Gert-Jan Roeleveld Dec 4 '18 at 14:52
  • Sorry for the delayed response. My Macbook has been down due to a bloated battery and a dying SSD. Both have been replaced and I have since retested this. Unfortunately this traffic is over port 80 and not port 53 so I am still at a loss. – James Flattery Jan 6 at 21:09
  • Some more details will be necessary to progress. Could you check which interface is used to provide your connection Wi-Fi, Ethernet, VPN over one of these? Add this key detail to your OQ.[return] Could you add in your OQ all the equipment which are involved between the MacBook and the connection to your ISP? – daniel Azuelos Jan 7 at 16:40
4

All these applications need the DNS (Domain Name System) to translate Internet names into their IP address, and the reverse.

The IP you found are the one of the DNS servers of Verizon. The following command will show it clearly:

 dig -x 151.205.0.101

Your udp and tcp exiting traffic toward DNS port = 53 should be permitted.

Fix your Little Snitch configuration so that all your DNS traffic could pass.

  • I’m guessing it is DNS requests however my MBP took a crap, battery looks like a ballon and the SSD is on the fritz, so I am waiting for the replacement battery before I power it back on and test this theory. Also, since you brought this up, I just now created a firewall rule to route all outbound DNS requests to my Pi-Hole. I will report back when battery is replaced. – James Flattery Dec 9 '18 at 15:37
  • I have been able to verify this is not DNS traffic. It is attempting to connect over port 80 (http) – James Flattery Jan 6 at 21:10
  • 2
    @JamesFlattery What DNS servers are you using? I’m guessing that is resolving Apple names incorrectly and feeding it to verizon / mci for their tracking / analytics / efforts to monetize you and your internet usage. Asking a follow on question that laser focuses on Apple services might be productive. There’s far too much going on in your question for me to try and reproduce or answer it, Props to Daniel for making a stab at it. – bmike Jan 6 at 21:25
  • I’m using Pi-hole and upstream to that is OpenDNS. I also created a firewall rule which redirects all outbound dns to the Pi-hole so only that is used within my network. – James Flattery Jan 6 at 21:27
  • "I also created a firewall rule […]" Could you add to your OQ which firewall you are talking of here? The internal one of your MacBook, the internal one of your Pi-hole, a physical firewall? – daniel Azuelos Jan 7 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .