IP Address Block My PC

sheen73

Hi all,
I recently started seeing an IP block under PFblocker report outbound for
156.96.59.10:27016 and 156.96.59.10:2311.

How can I figure out what that ip address is and whats doing it on my PC?

Gertjan

@sheen73 said in IP Address Block My PC:

I recently started seeing an IP block under PFblocker report outbound for
156.96.59.10:27016 and 156.96.59.10:2311.

Because :
You have a program (process) in your PC that wants to connect to that IP.
And
You added feeds (lists) pfBlockerNG to pfSense that conatins a domain name or IP that has that IP, or it's part of a network that il blocks.

So, "you"have already a lot of info ;)
The name of the feed in which you find the IP (or part of the network) should tell you something - see the Alert and DNSBL report page.

@sheen73 said in IP Address Block My PC:

How can I figure out what that ip address is and whats doing it on my PC?

What it is ? a quad number from 1 to 255. You mean : who owns it ?
Use the console/SSH access and ask who it :

whois 156.96.59.10

The IP doesn't have a reverse :

host 156.96.59.10
Host 10.59.96.156.in-addr.arpa not found: 2(SERVFAIL)

Which process is using this IP on your device ?
Here is where the device's firewall comes in - as some local 'network' commands.
Start by blocking for outgoing traffic that IP - and see what process starts to complain ?

sheen73

@Gertjan

Thank you sir, I'll try to find the program making the outbound calls.

I did run a search of the ip address and could not find much on what or who is on the receiving end.

NogBadTheBad

@sheen73

Have you tried googling the IP address, it would seem to be associated with a game.

It’s associated with your ARK server from previous posts.

sheen73

@NogBadTheBad

Thanks, that's what I was thinking but my googleFu did not show anything other than newtrend something or other so it had me worried.