Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Need help, OSX Virus connecting to: 2.20.188.163

Virus connecting out to random IP: 2.20.188.163

Whilst connecting to the internet, my NOD32 Cyber Security Process: eset_proxy connected to this IP address: 2.20.188.163


I've done a search on google:

https://gyazo.com/e069344010246521376d3ca5b9dc9f3b

https://gyazo.com/c3a43d477e607cec6a69fa617fa3a9fb


https://www.virustotal.com/en/ip-address/2.20.188.163/information/

This Virus total report indicates there have been detected files that communicate with this IP address.https://gyazo.com/e069344010246521376d3ca5b9dc9f3b


Checking the IP address, port 80, HTTP is open. When accessing the IP address via Chrome I am given this message.


Invalid URL

The requested URL "/", is invalid.

Reference #9.9fbc1402.1448377597.36f6112


Upon page refresh the reference number seems to keep changing.


If anyone can help shed some light on this strange behaviour I'd be most grateful.


Thanks.

MacBook Pro with Retina display, Mac OS X (10.5)

Posted on Nov 24, 2015 7:12 AM

Reply
9 replies

Nov 24, 2015 12:13 PM in response to QuickTimeKirk

How can this be the case when I still have so many hostnames that do the same thing.

I have removed antivirus...


This is what happens when I try to connect to it via my browser.


https://gyazo.com/30be3a00f5fcef1c510095678ea77727

https://gyazo.com/4bf34a277fc87ac4553f5d5d136d54a3

https://gyazo.com/173fe4a9da6d04385d54340c85d89c3f


These are the open ports


http://mxtoolbox.com/SuperTool.aspx?action=scan%3a2.20.188.163&run=toolpage


Thus I tired to connect via port 80.


EDIT:


Just uncovered this:


https://gyazo.com/418a7e73281461cb841862351508a27e

https://gyazo.com/21b2c5e443b8fc7a88193cf96c8891b9


Another hostname that my chrome browser seems to be connecting to, operating the same way.


AND ANOTHER...

http://a104-84-74-236.deploy.static.akamaitechnologies.com/

https://gyazo.com/2368a414d3ac174c1771d2528539b8e9


All are showing the same thing.


Here is a list of them from port monitor: https://gyazo.com/05d017bb0f2c33d065e7e42d71ef4029


All of them are operating in the same way...


There is also this: https://gyazo.com/4f8a38af68dd4f94d5ae352f596f1948


It seems to be redirecting to mixpanel? I am very confused...



*Sigh* There's more...


https://gyazo.com/b7f39c37c97950e801fc19501af39f8c


What the **** are all of these hostnames?


https://gyazo.com/2ef50b779da67b7bb8a29165bd09ccc0

Nov 24, 2015 1:52 PM in response to HappyDude1234

You're getting an awful lot of outright false, and misleading information.


IP address 2.20.188.163 doesn't even exist anywhere in the world. That is, there's no domain name anywhere that uses that address:

Address lookup

lookup failed2.20.188.163
Could not find a domain name corresponding to this IP address.


Further searching does use it as a linked inetnum of 2.20.188.0 - 2.20.191.255. That traceroute and whois shows that it belongs to Akamai. No idea why they would be trying to "steal" your data. A brief description of what they do:


Akamai is a cloud-based service provider specialized in content acceleration and security. Akamai has an immensely high number of globally distributed servers (150k+) which are very close to end users. This is also combined with caching, route optimizations, and distributed security and firewall mechanisms.


So are you using some sort of online data service other than iCloud?

Need help, OSX Virus connecting to: 2.20.188.163

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.