Quick context: Home network, performing some DPI on my perimeter router (Ubiquiti EdgeRouter Lite) that governs 2 internal subnets separating my traffic from a bunch of roommate devices. No IDS on the network yet, so I don't have many logs to investigate.
I noticed an IP outside of the private range via DPI dashboard. I have pretty strict firewall rules and haven't seen outside IPs before. The address responds to pings and has a few services up/filtered, but no whois information or nslookup can be found. Visiting this IP's HTTP server lands me at a page displaying "Monitoring Page - sorry-hostname-not-available.imrworldwide.com". From https://www.findip-address.com/ it appears to be a local business? The IP address disappeared from my dashboard shortly after I looked around, which leads me back to thinking ubiquiti is just buggy. No additional mac addresses show up on my switch that all internal traffic flows through. As I was looking into this, I noticed the Ubiquiti AP on my less-trusted "roommate" network received 67kB from "DNS" (this is also something I've never seen before). Why would this AP be receiving DNS responses and transmitting 0kB?
All-in-all I'm just a little confused. Should I be concerned about this? Is this just Ubiquiti being buggy and doing weird things? Regardless, I'm implementing an IDS and making a tin-foil hat tonight :)
The IP itself is 18.104.22.168.