I'm routinely going through our firewall logs, and recently I noticed that a lot of our Windows 10 clients are trying to open file shares (or otherwise connect to tcp/445) on the IP 10.10.10.1. Since this IP does not exist in our network (we use the 172.16.0.0/12 range exclusively), this struck me as odd. Unfortunately, the web isn't much help in this regard, since that IP is used for thousands of router configuration guides and examples.
The PCs doing this are spread through all departments, I couldn't determine any software common to these machines, except the usual stuff like MSOffice, Skype, Firefox.. I've gone through config files and the registry, that IP turns up nowhere.. so it's most likely hardcoded in whatever program this comes from.
As the IP does not exist, all I see are the SYNs on the firewall, I don't know yet what these connections are trying to reach.. perhaps a share name would give the solution. But this would mean setting up a honeypot or similar, which takes significant time, and so I pushed that idea back behind "ask SE" ;-)
We are using four different AV solutions on our PCs, so if it was something malicious, it would have been able to stay hidden from all of them. Also, it would have to be a rather dumb virus/worm to try spreading to IPs outside the PCs local network.
I tried running ProcExp one one of the machines that I see these connections coming from, but a day of monitoring did not turn anything up. This makes me a bit uneasy, because it would point into the "malicious" direction if it ceases the connection attempts as soon as some well-known monitoring software is running. On the other hand, it might also just be pure chance, or originating somewhere that ProcExp can't inspect (where could that be?). I'm a Unix/Network guy, my knowledge of Win10 internals is kinda limited.
Is someone else seeing this, and can probably point at a culprit?