My House is Under Attack! What’s that you say? The Calls are Coming from Inside?!??!!?

[Foxbat]

I have a Synology RT-2600 that I am using for my main Wi-Fi signal, and it’s been working great for us. Today, while at work, my Apple Watch starts binging and buzzing my wrist, and when I look, I see that it has blocked access to an IP address. Problem is, there isn’t anyone at home! There shouldn’t be any activity.

Let’s look, shall we?

These have been popping up all day and have continued since I came home. I did Google and apparently the address belongs to a CDN based in California, with Reddit reporting mostly Apple devices attempting this connection, plus some Windows devices.

Since this is a Wi-Fi connection for me, this is most likely my iPad. I checked the logs on the Synology and yep, there’s my iPad. And once I got home, my iPhone and now my MacBook as I am making adjustments to the Synology.

Redditors think it’s a False-Positive, and the Synology User Forum apparently tracked it down to DigiCert moving some services to new dedicated IPv4 Addresses as outlined here: New Dedicated IP Addresses

But before I tracked that down, yeesh! How annoying! But, good to know my Synology was trying to keep me safe…

 

[TRG]

Report to your safe room immediately!!!

 

[cpalmer2k]

Do you have the "Limit IP Address Tracking" option enabled on your iOS devices by any chance? (To see, click on WiFi in settings and then tap on the "i" symbol on the right side of your active connected network. If I had to guess I'd say it is connected to that.

 

[Foxbat]

About 01:30 EST Thursday these alerts went away. I guess Synology (based in Taiwan) got around to adding this address to the White List.