Discussion
Okay so 20.55.61.179 is a strange IP address. It comes up in my nginx access log all the time, but what it's accessing is stuff that's never publicized or linked to anywhere, and those accesses usually come shortly after I've spun up a new service.
The address is owned by Microsoft and I have a feeling that some browser thing I have is phoning home to trigger its attention, but I can't figure out any rhyme or reason to what it might be.
Anyone else seen this address in logs and have any ideas?
@fluffy One day I will have enough time to search my logs for that IP.
What AV do you use (if any?).
Do you have any plugins on your browser that may be taking the URLs and checking for badness on new / unknown urls?
In particular, the two times I see it in my logs from the past week:
1. I spun up a new public reverse proxy to one of my in-home network services so that I can access it remotely, and it just loaded the login page and gave up
2. It was poking at my munin dashboard which is protected by HTTP Basic Auth
Neither of the hostnames in question would appear in any public TLS audit logs (since they're covered by my existing wildcard cert) and the timing on the accesses is quite peculiar.
All of the accesses lack HTTP referer headers, and the user-agent indicates Chrome on Windows 10/11, which is also not a browser and OS combination I've used to access any of these things. But the user-agent is stable.
In all cases it's just loading the index page and its linked resources and then doing nothing else, which makes me think it's some sort of thumbnail service for a browser or something.
Install Fedizen
Get the full app experience
@fluffy did you figure it out?