Traffic From One Computer to Cloudfront.net

FormerMember

Hi, All.

I'm a newbie here in search of ANY kind of answer to an issue I am experiencing with one computer, which randomly goes out to cloudfront.net and has a nearly hour long conversation, completely eating up every ounce of bandwidth.  We are on a corporate circuit and are capped at 3 mg (I know, right?!).

I have scoured the user's computer for ANY kind of reference to cloudfront.net, including searching programs, msconfig, task manager, the registry, browser add-ons, processes....  nothing.  Google has NOT been my friend today as it has returned virtually nothing of help.  There is no malware on the computer, the browser has not been hijacked....   it is just very chatty with two IPs:  13.33.166.172 and 52.84.63.69.

I finally stumbled upon this site by typing in Orion Netflow and I got a result that mentioned the same site but cannot find it on this site.  Please see the attached.

ANY IDEAS WOULD BE APPRECIATED!!!

Thanks in advance.

AH

2017-09-19 14_49_03-NetFlow Domain - cloudfront.net - Internet Explorer.png

jrouviere

Hello arh95,

I don't have anything solid to offer as this isn't something that I've seen myself, but here's some thoughts and suggestions that may help resolve the issue:

1. The data is certainly originating from your worstation, you just haven't seen it.
2. If you've narrowed it down to a specific workstation I would check:
   • Wireshark on the local machine to verify the traffic is coming from the workstation.
   • Ports - It's possible that the ports will help you narrow the field on what's happening.
   • Logs - Especially Windows Logs such as the Application Log that might indicate a service starting/stopping to match the window of your traffic spike.
   • Run a tasklist - Save a List of Running Processes to a Text File in Windows
   • Run PerfMon to see if anything else is going on.
3. It's worth noting that you can also use the Flow Navigator to check the information you're seeing and filter down to just that domain - Is it possible to generate a report of which Machine is communicating with *.cloudfront.net and how much traffic is cons…
   • Use NetFlow Flow Navigator - SolarWinds Worldwide, LLC. Help and Support
4. It may be a longshot, but it might be worth reaching out to Amazon to see if they can tell you anything about the servers or the traffic.
5. Re-image the machine.  If it's not doing something sanctioned, I would be concerned that it's sending an hours worth of unknown traffic.  It's possible that re-imaging the machine is a quick and effective way to stop what's happening, if not helping you identify what is actually happening.
   • Take the extra precaution to verify this is just a regular workstation and not somehow running something critical to your environment.  Maybe try the scream test and replace it for the end user if you can, leave it off for a few days, and once that's passed with no new mysterious HD tickets then get it imaged and back into inventory.