Unknown traffic to known bad actor

[Chris Wilson <clwilson () MTROYAL CA>]

I'm reaching out to see if anyone else has seen activity from their network
to the following IP address: 204.11.56.48

All interactions we've seen is the source traffic is not OS specific.
We're wondering if it might be a malicious Chrome/Firefox extension?  We've
quarantined one of our internal workstations and are in the process of
running scans on the unit to determine root-cause.  ArcSight and Firepower
is only seeing SSL (443) traffic. The IP in question has been blocked on
our firewalls for some time due to it's reputation, therefore no
connections have been established.

Our issue is that we can't seem to determine the source of the activity on
the endpoint, therefore we have no way to re mediate.  Has anyone else
seen, or experienced anything from this IP: [hxxps]://
www.virustotal.com/gui/ip-address/204.11.56.48/relations

Any help would be appreciated.
Thank you in advance,


Chris Wilson
Security Architect
I.T. Services Department
Mount Royal University
4825 Mount Royal Gate SW
Calgary, AB
403-440-8682
clwilson () mtroyal ca