Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now I have denied access to most of their IP addresses, but I get a lot more connection attempts from other services like Leaseweb and whatnot. However, it still puzzles me as to why they want to connect. AFAIK via Bonjour mDNSResponder advertises network services (such as AFP file sharing) provided by my computer, as well as my self-chosen ".local" name.
In principle, I deny any connection to outside servers that are not Apple's.
Any further insights would be highly appreciated.
Recently I'm seeing access attempts by servers belonging to The Shadow Server Foundation to mDNSResponder (via Little Snitch actually). I got access attempts from 184.105.247.199, 184.105.247.227 and 184.105.247.207. While their mission might sound laudable,
Established in 2004, The Shadowserver Foundation gathers intelligence on the darker side of the internet. We are comprised of volunteer security professionals from around the world. Our mission is to understand and help put a stop to high stakes cybercrime in the information age.
I don't appreciate these attempts, so I block them (thanks, Little Snitch!).
My network configuration looks like this:
In an attempt to block all of their IP ranges, I came across this web page on myip.ms, which lists these domain names under "Websites hosted by The Shadow Server Foundation". Among them a few dubious sounding domain names:
- malwr.com
- tvbsp.com
- foottraffix.com
- bilescotrej.com
- make-cash-at-home.com
- profit-case.com
- alfa-cash.com
- milerteddy.com
- sexy-ladies-wantmeet.com
- ladies-with-big-tits.com
Without having visited any of these, I'm wondering if anyone knows anything about these sites. Why is The Shadow Server Foundation trying to get access to my Mac?