My firewall identifies an unusual amount of traffic to 184.108.40.206 from host 192.168.76.22 (a Mac OS X Server). Within that server, the network connections are defined with a primary DNS pointing to my ISP's DNS server and the secondary address pointing to the Google Public DNS at 220.127.116.11. None of the settings in this system have been set to use 18.104.22.168.
Another post at Forensics - trace back DNS query origin on host? suggests that I might have to change the resolver in order to find the guilty processes.
I have checked a similar question for assistance, but found no useful answers there as to checking the source. I have run netstat and not identified any communication to 22.214.171.124 listed on the output.
I am wondering:
1) If there is a system log that would allow me to identify the necessary information
2) If there is an easier method than replacing the system's DNS resolver
3) How to replace the resolver (if this is absolutely necessary)
OS: Mac OS X 10.10.5
Server Application Version: 5.0.3
Firewall: Watchguard XTM 505