I have only just seen this post. Ok about 2 years ago I had similar dealings with this address coming out of my machine.
So this is just a GoogleCast/ChromeCast ??
From my own computer and research im not so sure at all.
Everything on my machine was upto date at the time, so you wouldnt expect to be seeing any unknown applications running from the system, but there was and quite a few.
For me ipv4 is a 1 to 1 connection and ipv6 is a multicast unicast connection. So i thought i would disable ipv6 from the Local area network, router and all apps and all firewall permissions that seem to be default using multicast.
Also I removed any services for ipv6, translation, tunneling, basically as much as i knew i could without screwing the system up.
I thought that should take care of it, but checking again after, it was still running.
So now i tracked it down to a Windows svchost, with a PID process number of 4. How can this be embedded into my operating system like this?
So more digging and without any ipv6 running i managed to pin point the remote connection addresses far easier.
Just from information within the resource monitor it now looks like this is actually some form of Windows 'Speed Test'
More research would suggest these bogus and bullshit svchosts are actually Windows Speed tests, Remote Speed tests, Internet Speed tests. All cleverly installed and placed into the Windows Task Schedular and nicely hidden from a normal user.
Lets get down to the useful information which I managed to translate myself. You may find interesting.
Local addresse on my comp:
184.108.40.206 svchost PID=4 + PID=2584
These were connecting to multiple remote addresses. I did my research here. Speed test? Yeah right.
Speed test addresses looks like this,
- 220.127.116.11 = 1e100.net - Google
- 18.104.22.168 = 22.214.171.124 - Akamai Tech (Steam)
- 126.96.36.199 = 188.8.131.52 - Verizon Edgecast Netblk
- 184.108.40.206 = 220.127.116.11 - Akamai Tech
- 18.104.22.168 = 22.214.171.124 - Amazon Key logging?
- 126.96.36.199 = 188.8.131.52 - cloudfront.net (Amazon)
- 184.108.40.206 = 220.127.116.11 - cloudfront.net (Amazon)
Type = Remote Speed Tests - Ports 443 + 49000 range
- 18.104.22.168 = Microsoft Azure
- 22.214.171.124 = Highwinds Network Group
- 126.96.36.199 = Akamai Technologies (steam i think)
Ipv6 converted addresses found attacking my machine,
- 0:0:0:ffff%1 = 188.8.131.52 = Microsoft Azure
- 0:0:0:ffff%2 = 184.108.40.206 = Microsoft Azure
- 0:0:0:ffff%3 = 220.127.116.11 = Microsoft Azure
- ::/64 = 18.104.22.168 = Verizon Business
- :: = 22.214.171.124 = Microsoft?
Back in the day, you had to enable things to make them work. Nowadays everything is on by default.
Privacy? There basically isnt any these days.
Anyways good luck and for anyone else readin this I hope this information helps you out some.