<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span style='mso-fareast-language:EN-US'>Interesting thought, but that last one does not look like WU. </span>services.gfe.nvidia.com<span style='mso-fareast-language:EN-US'><o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'>I’ll drop an email to NL support and see if they have an explanation.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b>From:</b> Jeff Westhead <jeffrey.j@microsoft.com> <br><b>Sent:</b> Tuesday, January 30, 2024 5:27 PM<br><b>To:</b> unbound-users@lists.nlnetlabs.nl; RayG <rgsub1@btinternet.com><br><b>Subject:</b> Re: [EXTERNAL] RE: Unbound-Control.exe outgoing connections<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Aptos",sans-serif;color:black'>Disclaimer that I am not a WU expert... Windows connects to Windows Update servers periodically but I can't explain why the connection would originate from the unbound control process. Is there any chance this is being misreported somehow? Could you perhaps try running Netlimiter on a machine that doesn't have Unbound installed? It should detect the same outgoing connections.<o:p></o:p></span></p></div><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="98%" align=center></div><div id=divRplyFwdMsg><p class=MsoNormal><b><span style='color:black'>From:</span></b><span style='color:black'> Unbound-users <<a href="mailto:unbound-users-bounces@lists.nlnetlabs.nl">unbound-users-bounces@lists.nlnetlabs.nl</a>> on behalf of RayG via Unbound-users <<a href="mailto:unbound-users@lists.nlnetlabs.nl">unbound-users@lists.nlnetlabs.nl</a>><br><b>Sent:</b> Tuesday, January 30, 2024 6:06 AM<br><b>To:</b> <a href="mailto:unbound-users@lists.nlnetlabs.nl">unbound-users@lists.nlnetlabs.nl</a> <<a href="mailto:unbound-users@lists.nlnetlabs.nl">unbound-users@lists.nlnetlabs.nl</a>><br><b>Subject:</b> [EXTERNAL] RE: Unbound-Control.exe outgoing connections</span> <o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p></div></div><div><div><p class=MsoNormal style='margin-bottom:12.0pt'>Here is another example that has just popped up.<br><br>I use Netlimiter (<a href="https://www.netlimiter.com/">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.netlimiter.com%2F&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567253478%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=496KNnRYxVlygcr82eXegTMGoqt4wyj6wKHGdC%2BYVoc%3D&reserved=0</a>) to ask about all outgoing<br>connections then I I agree with what is being asked for I allow it and it<br>will work without issue from then on.<br><br>I have purposely left the setting as ask as I wanted to capture as many<br>instances as possible I could select deny and I would never get that popup<br>again.<br><br>I am hoping this will be useful at some point. The process ID no longer<br>exists in my system. I will take a look next time it pops up, that may shed<br>some more light.<br><br>Outgoing connection - TCP(6)<br>From<br>Unbound Remote Control Tool<br>services.gfe.nvidia.com<br>To<br>London, United Kingdom of Great Britain and Northern Ireland<br>Application:<br>Process ld:<br>Local Address:<br>Remote Address:<br>unbound-control.exe<br>Process 14668<br><My IPv4 address> Port 56914<br>152.199.20.80 Port: 443 Whois<br><br>RayG<br><br>-----Original Message-----<br>From: RagG <<a href="mailto:rgsub1@btinternet.com">rgsub1@btinternet.com</a>> <br>Sent: Sunday, January 28, 2024 8:33 PM<br>To: <a href="mailto:unbound-users@lists.nlnetlabs.nl">unbound-users@lists.nlnetlabs.nl</a><br>Subject: Unbound-Control.exe outgoing connections<br><br>Hi, Has anyone any idea of why on rare occasions Unbound-control.exe wants<br>to make the connection detailed below?<br><br>They pop up at random times and for do apparent reasons. I thought this<br>program was (mainly) to control the local instance.<br><br>Thanks<br><br>Outgoing connection - TCP(6)<br>From: Unbound Remote Control Tool<br>To: 20.54.24.148<br>Dublin, Ireland<br>Application: unbound-control.exe<br>Process ld: Process 10956<br>Local Address: <My IPv4 address> Port 56817 Remote Address: 20.54.24,148<br>Port 443 Whois<br><br>===========================================<br><br>C:\>dig -x 20.54.24.148<br><br>; <<>> DiG 9.17.14 <<>> -x 20.54.24.148<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43656 ;; flags: qr rd<br>ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags:; udp: 1232<br>;; QUESTION SECTION:<br>;148.24.54.20.in-addr.arpa. IN PTR<br><br>;; AUTHORITY SECTION:<br>24.54.20.in-addr.arpa. 157 IN SOA ns1-01.azure-dns.com.<br>azuredns-hostmaster.microsoft.com. 1 3600 300 2419200 300<br><br>;; Query time: 3 msec<br>;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) ;; WHEN: Sun Jan 21 17:16:21 GMT<br>Standard Time 2024 ;; MSG SIZE rcvd: 140<br><br>===========================================<br><br><br>Whois information:<br><br>#<br># ARIN WHOIS data and services are subject to the Terms of Use # available<br>at: <a href="https://www.arin.net/resources/registry/whois/tou/">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.arin.net%2Fresources%2Fregistry%2Fwhois%2Ftou%2F&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567262053%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=NQzfhAL2YHNENEAv%2BUkmXvc%2F3gFU7n7Z3DGpTGBbG5k%3D&reserved=0</a><br>#<br># If you see inaccuracies in the results, please report at #<br><a href="https://www.arin.net/resources/registry/whois/inaccuracy_reporting/">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.arin.net%2Fresources%2Fregistry%2Fwhois%2Finaccuracy_reporting%2F&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567267861%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=CWfJVqiQSo36Cv5w6bnN8%2F5p1V1QPhQeGEUGS9l%2BueE%3D&reserved=0</a><br>#<br># Copyright 1997-2024, American Registry for Internet Numbers, Ltd.<br>#<br><br><br>NetRange: 20.33.0.0 - 20.128.255.255<br>CIDR: 20.33.0.0/16, 20.40.0.0/13, 20.128.0.0/16, 20.64.0.0/10,<br>20.36.0.0/14, 20.34.0.0/15, 20.48.0.0/12<br>NetName: MSFT<br>NetHandle: NET-20-33-0-0-1<br>Parent: NET20 (NET-20-0-0-0-0)<br>NetType: Direct Allocation<br>OriginAS: <br>Organization: Microsoft Corporation (MSFT)<br>RegDate: 2017-10-18<br>Updated: 2021-12-14<br>Ref: <a href="https://rdap.arin.net/registry/ip/20.33.0.0">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Frdap.arin.net%2Fregistry%2Fip%2F20.33.0.0&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567272611%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=2fgj45WI2KYyCCm1ZFEMMUGMbeZplYjvdmKXjuVK440%3D&reserved=0</a><br><br><br>OrgName: Microsoft Corporation<br>OrgId: MSFT<br>Address: One Microsoft Way<br>City: Redmond<br>StateProv: WA<br>PostalCode: 98052<br>Country: US<br>RegDate: 1998-07-10<br>Updated: 2023-11-17<br>Comment: To report suspected security issues specific to traffic<br>emanating from Microsoft online services, including the distribution of<br>malicious content or other illicit or illegal material through a Microsoft<br>online service, please submit reports to:<br>Comment: * <a href="https://cert.microsoft.com/">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcert.microsoft.com%2F&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567277530%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=FefpIgyusZduSzyH8OSsksUy%2Bkc6fQkc59GerrCREcQ%3D&reserved=0</a>. <br>Comment: <br>Comment: For SPAM and other abuse issues, such as Microsoft<br>Accounts, please contact:<br>Comment: * <a href="mailto:abuse@microsoft.com">abuse@microsoft.com</a>. <br>Comment: <br>Comment: To report security vulnerabilities in Microsoft products<br>and services, please contact:<br>Comment: * <a href="mailto:secure@microsoft.com">secure@microsoft.com</a>. <br>Comment: <br>Comment: For legal and law enforcement-related requests, please<br>contact:<br>Comment: * <a href="mailto:msndcc@microsoft.com">msndcc@microsoft.com</a><br>Comment: <br>Comment: For routing, peering or DNS issues, please <br>Comment: contact:<br>Comment: * <a href="mailto:IOC@microsoft.com">IOC@microsoft.com</a><br>Ref: <a href="https://rdap.arin.net/registry/entity/MSFT">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Frdap.arin.net%2Fregistry%2Fentity%2FMSFT&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567283058%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=OVnrAMDQhaeZgs7y1nb0YUz3V8QJzxfVw9jP38XCGPY%3D&reserved=0</a><br><br><br>OrgAbuseHandle: MAC74-ARIN<br>OrgAbuseName: Microsoft Abuse Contact<br>OrgAbusePhone: +1-425-882-8080<br>OrgAbuseEmail: <a href="mailto:abuse@microsoft.com">abuse@microsoft.com</a><br>OrgAbuseRef: <a href="https://rdap.arin.net/registry/entity/MAC74-ARIN">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Frdap.arin.net%2Fregistry%2Fentity%2FMAC74-ARIN&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567287375%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=951dus5Qq9qBOisYgkrMZTA%2FuyaTt6d9%2BqcXZXyatNo%3D&reserved=0</a><br><br>OrgTechHandle: MRPD-ARIN<br>OrgTechName: Microsoft Routing, Peering, and DNS<br>OrgTechPhone: +1-425-882-8080<br>OrgTechEmail: <a href="mailto:IOC@microsoft.com">IOC@microsoft.com</a><br>OrgTechRef: <a href="https://rdap.arin.net/registry/entity/MRPD-ARIN">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Frdap.arin.net%2Fregistry%2Fentity%2FMRPD-ARIN&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567292166%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=gmsX8Q4CXSusl6Xk%2BHEYKvPvULCgTbxtJXimzyJdwNo%3D&reserved=0</a><br><br>OrgTechHandle: SINGH683-ARIN<br>OrgTechName: Singh, Prachi <br>OrgTechPhone: +1-425-707-5601<br>OrgTechEmail: <a href="mailto:pracsin@microsoft.com">pracsin@microsoft.com</a><br>OrgTechRef: <a href="https://rdap.arin.net/registry/entity/SINGH683-ARIN">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Frdap.arin.net%2Fregistry%2Fentity%2FSINGH683-ARIN&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567296943%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=vg01RfxJ%2BeidN0IkbTrUepMCDH4eELMqubqKfFCSs%2BI%3D&reserved=0</a><br><br>OrgTechHandle: BEDAR6-ARIN<br>OrgTechName: Bedard, Dawn <br>OrgTechPhone: +1-425-538-6637<br>OrgTechEmail: <a href="mailto:dabedard@microsoft.com">dabedard@microsoft.com</a><br>OrgTechRef: <a href="https://rdap.arin.net/registry/entity/BEDAR6-ARIN">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Frdap.arin.net%2Fregistry%2Fentity%2FBEDAR6-ARIN&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567301713%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=zkbzTuh6AZdpuOxp6dr%2FeFr97Z1xdu1umLy4bL%2Fh%2B9I%3D&reserved=0</a><br><br>OrgTechHandle: IPHOS5-ARIN<br>OrgTechName: IPHostmaster, IPHostmaster <br>OrgTechPhone: +1-425-538-6637<br>OrgTechEmail: <a href="mailto:iphostmaster@microsoft.com">iphostmaster@microsoft.com</a><br>OrgTechRef: <a href="https://rdap.arin.net/registry/entity/IPHOS5-ARIN">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Frdap.arin.net%2Fregistry%2Fentity%2FIPHOS5-ARIN&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567306662%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=f7gMzxAcV98iy81ltKqJRD4y974zz0%2FlMz9nsg7FJpM%3D&reserved=0</a><br><br>OrgRoutingHandle: CHATU3-ARIN<br>OrgRoutingName: Chaturmohta, Somesh <br>OrgRoutingPhone: +1-425-882-8080<br>OrgRoutingEmail: <a href="mailto:someshch@microsoft.com">someshch@microsoft.com</a><br>OrgRoutingRef: <a href="https://rdap.arin.net/registry/entity/CHATU3-ARIN">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Frdap.arin.net%2Fregistry%2Fentity%2FCHATU3-ARIN&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567311494%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=goItgF8ocOzm84IaNR7SC%2BVGY15p3uPWb9fXeNBVq9E%3D&reserved=0</a><br><br><br>#<br># ARIN WHOIS data and services are subject to the Terms of Use<br># available at: <a href="https://www.arin.net/resources/registry/whois/tou/">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.arin.net%2Fresources%2Fregistry%2Fwhois%2Ftou%2F&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567316212%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=fFLetWcTv%2BXbks1bLGcj0A2dfrltlO1Ufe%2BsEYwkpcY%3D&reserved=0</a><br>#<br># If you see inaccuracies in the results, please report at<br># <a href="https://www.arin.net/resources/registry/whois/inaccuracy_reporting/">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.arin.net%2Fresources%2Fregistry%2Fwhois%2Finaccuracy_reporting%2F&data=05%7C02%7Cjeffrey.j%40microsoft.com%7Cac65edc06dd6487ae25c08dc219ccd8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638422204567320397%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=esT7aa30u2y%2B2ZnJHUom%2BhfWY24YzIiGXw8Z8VpFT3Y%3D&reserved=0</a><br>#<br># Copyright 1997-2024, American Registry for Internet Numbers, Ltd.<br>#<br><br><br>Regards<br>Ray<br><br><br><br><o:p></o:p></p></div></div></div></body></html>