Troubleshooting source of outgoing traffic to specific IP

[SWood]

We're starting to see a major uptick in Blocked web site traffic to a specific set of IPs. Many of our systems are seeing the same thing.

Blocked web site              Type: outgoing, Port: 55724, Process: iexplore.exe           8.34.112.224

Blocked web site              Type: outgoing, Port: 55723, Process: iexplore.exe           8.34.112.224

Blocked web site              Type: outgoing, Port: 55725, Process: iexplore.exe           8.34.112.225

Blocked web site              Type: outgoing, Port: 55726, Process: iexplore.exe           8.34.112.225

Blocked web site              Type: outgoing, Port: 55727, Process: iexplore.exe           8.34.112.224

 

We've scanned our clients and can't see what's causing the repeated attempts. Does anyone have any ideas, suggestions on how to find what's originating the connection attempts?

[Rsullinger]

Hello Swood,

 

Normally if you see an outgoing block in a browser it is usually 1 of 2 scenario. Either it is an infection or a blocked connection that the user is making (either ad or bad page). If you are noticing this happen all the time and your users are not reporting their sites are being blocked, then it may be an infection. I would like to have you grab me some logs to take a closer look at this. If you would like to this, send me a PM with your e-mail and I will create a support case to look into this further for you. 

 

-Ron

[SWood]

17 hours ago, Rsullinger said:

Hello Swood,

 

Normally if you see an outgoing block in a browser it is usually 1 of 2 scenario. Either it is an infection or a blocked connection that the user is making (either ad or bad page). If you are noticing this happen all the time and your users are not reporting their sites are being blocked, then it may be an infection. I would like to have you grab me some logs to take a closer look at this. If you would like to this, send me a PM with your e-mail and I will create a support case to look into this further for you. 

 

-Ron

Thanks Ron. I sent you an email and would like to submit some logs to see if you can help me out.

[SWood]

Ron,

Should I just try and open another support case online? I've put two in but not heard back from anyone........