72.21.91.29??
-
Hi, All
Just wondering each time when login to pfSense webUI, there will be a connection issued to 72.21.91.29:80, which currently was blocked by the one of pfBlockerNG's Malware rules. Is this IP related to the pfSense Host Servers? if so whats for??
-
Source: whois.arin.net IP Address: 72.21.91.29 Name: EDGECAST-NETBLK-01 Handle: NET-72-21-80-0-1 Registration Date: 4/23/07 Range: 72.21.80.0-72.21.95.255 Org: MCI Communications Services, Inc. d/b/a Verizon Business Org Handle: MCICS Address: 22001 Loudoun County Pkwy City: Ashburn State/Province: VA Postal Code: 20147 Country: UNITED STATES Name Servers:
Look at the active states after login for matching address and you'll see what kind of connection it is.
-
TCP:S?
-
I would say its related to digicert
https://www.virustotal.com/en/ip-address/72.21.91.29/information/
-
TCP:S?
I meant look at the destination port number to figure out if it's a HTTP/HTTPS or something else.
-
72.21.91.29:80
-
my guess would be its something pulling a crl for a digicert
http://crl3.digicert.com/sha2-ha-server-g5.crl
Is on that IP..
-
my guess would be its something pulling a crl for a digicert
http://crl3.digicert.com/sha2-ha-server-g5.crl
Is on that IP..
Should I suppress it? What is pfSense doing to issue a connection to this IP?
-
my guess would be its something pulling a crl for a digicert
http://crl3.digicert.com/sha2-ha-server-g5.crl
Is on that IP..
Should I suppress it? What is pfSense doing to issue a connection to this IP?
Like already noted it's pulling a certificate revocation list (CRL) to update it in case the certificate has been revoked for whatever reason. You should be able to make your own call if you want this to happen or not.