My firewall identifies an unusual amount of traffic to 126.96.36.199 from host 192.168.76.22 (a Mac OS X Server). Within that server, the network connections are defined with a primary DNS pointing to my ISP's DNS server and the secondary address pointing to the Google Public DNS at 188.8.131.52. None of the settings in this system have been set to use 184.108.40.206.
Another post at Forensics - trace back DNS query origin on host? suggests that I might have to change the resolver in order to find the guilty processes.
I have checked a similar question for assistance, but found no useful answers there as to checking the source. I have run netstat and not identified any communication to 220.127.116.11 listed on the output.
I am wondering:
1) If there is a system log that would allow me to identify the necessary information
2) If there is an easier method than replacing the system's DNS resolver
3) How to replace the resolver (if this is absolutely necessary)
OS: Mac OS X 10.10.5
Server Application Version: 5.0.3
Firewall: Watchguard XTM 505