What are strange IPs?

[Tony Montana]

Hello! I checked my tcpdump today. What are strange IPs?

185.166.143.34

185.166.143.35

They open the Atlassian. what are they for?

[Harald Seyr · Accepted solution]

Hi @Tony Montana 

From whois, those IPs seem to be owned by Atlassian themselfes, as I understand the Netherlands branch: Whois IP 185.166.143.34

So this gets a "probably legit" from me, but you can always do some more analysis.

It would be helpful to know what they open. Since your post is tagged with "server", I assume you host your own instance and have access to the logs. If you share the relevant part of the access and error log, then we can check this also.

Regards,

Harald

[Tony Montana]

This 443 port, packets are not oppens

[Harald Seyr]

In case of incoming packets, I suspect atlassian checking your site in some automated process.

In case of outgoing packets, I suspect your instance does contact some central atlassian server, eg for license validation or check for updates.

In any case, either your firewall or your access / error log should contain some more hints.

[Tony Montana]

@Harald Seyr I've blocked this IPs for OUTGOING