My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following.
I'm noticing taffic from our network to the following IP address: 22.214.171.124 . I see from http://robtex.com that this IP address belongs to a CDN provider (Level 3 Communications) and that the IP seems to be used a lot for porn stuff, via rncdn1.com sub-domains among others (see http://www.robtex.com/ip/126.96.36.199.html#ip).
Thinking that I had infected machines in our network (one of the source was a Windows server, and our sysadmins are not addicted to porn!), I fired up Wireshark to find out the contents of the packets. The packets contained what seem to be valid Windows Update requests:
HEAD /v9/windowsupdate/redir/muv4wuredir.cab?1204161927 HTTP/1.1\r\n GET /v9/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab?1204161927 HTTP/1.1\r\n GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\n . . .
I know that these can be good-looking requests that are in fact "bad stuff hidden", but I'm wondering: could this be valid traffic and it's just Microsoft using this CDN for its updates? I find it weird that Microsoft would use a CDN that is also used to serve porn stuff. But then again, we've seen stranger things :-)