I noticed while hanging in Microsoft Network Monitor that my computer is sending ICMP echo request to an arbitrary IP address 202.39.253.11
.
I looked for the owner of this IP and I found it is owned by some Chinese or Taiwanese communication business called HINET. They seem to have a website at this address, although answers seem to come 202.39.253.12
.
I was wondering, am I at risk of opening myself to ICMP tunneling from a remote attacker?
I looked at the packets and they all look the same:
08 00 6E 89 00 01 00 14 49 43 4D 50 20 65 63 68 6F ..n....ICMP echo
08 00 6E 88 00 01 00 15 49 43 4D 50 20 65 63 68 6F ..n....ICMP echo
The answers are all the same, except for 9 bytes of 00 data at the end of the answer payload. I know by seeing this that no data is exchanged at the moment, but is it possible that a "spy" software is installed on my computer and could start sending data at some point?
EDIT: They seem to own 202.39.128.0/17