since I upgraded to the latest 7.3.4 my firewall is reportin my Unraid server attempting ot connect to:

185.84.108.20

Region

Russian Federation

Port

443

That IP is not one Unraid OS uses. It belongs to a Russian hosting company and resolves to a shared web hosting server, so it hosts many unrelated websites. Unraid's own servers (updates, license keys, Connect, Community Applications) are all behind Cloudflare. The update itself is very unlikely to be the cause, and the timing is most likely a coincidence, for example a container or plugin that was updated or restarted at the same time.

Your firewall only sees the server's IP. Docker containers on bridge networks and VMs using NAT go out with that same IP, so the first step is to find out which process is making the connection. While the firewall is reporting it, open a terminal on the server and run:

ss -tnp | grep 185.84.108.20

If this shows a process, it gives you its name and PID. To check whether that PID belongs to a container:

cat /proc/<PID>/cgroup

docker ps --no-trunc | grep <container id from the previous output>

If ss shows nothing, the connection is probably coming from a container on a bridge network or from a VM. Check with:

grep 185.84.108.20 /proc/net/nf_conntrack

The src= address in the output shows where the connection starts. A 172.17.x.x type address is a Docker container, and your VM's IP points to that VM.

Also check whether your firewall logs the DNS name or the SNI hostname for that connection. That tells you which website on the shared server is being contacted, and that usually explains the cause. If you still can't find the source, disable Docker and VMs in Settings and see if the alerts stop. If they stop, start the containers one at a time. If they don't stop, boot in safe mode to rule out plugins.

Then please post your diagnostics (Tools > Diagnostics), ideally taken while the connections are happening, together with the output of the commands above.

thanks for the tips

26 minutes ago, turbo bob said:

since I upgraded to the latest 7.3.4 my firewall is reportin my Unraid server attempting ot connect to:

185.84.108.20

Region

Russian Federation

Port

443

Soooo, did we dabble with makemkv?

here is my diagnostics file

nassrv-diagnostics-20261023-1204.zip

I have stopped most the dockers, and the activity appears to have stopped. Now to find which one it causing it...

I thought it was plex, it is not.

I also suspected the UConnect, management plugin which I uninstalled.

I have to run out, will circle back on this later.

For now it has stopped.

4 minutes ago, turbo bob said:

I have stopped most the dockers, and the activity appears to have stopped. Now to find which one it causing it...

I thought it was plex, it is not.

I also suspected the UConnect, management plugin which I uninstalled.

Oct 22 17:57:38 NASSRV rc.docker: connecting MakeMKV to network bridge

20 minutes ago, Mainfrezzer said:

Soooo, did we dabble with makemkv?

Well well well. It hosts some files, noteably some sdf.dat.gz file. which is supposedly some hashfile key. Its noted in some ancient posts and even in a newer one. Whois IP 185.84.108.20 - www.makemkv.com

But would have taken only a bit of searching to find that out

Edited 13 hours ago13 hr by Mainfrezzer
fix link

WOW, thanks yes one of the dockers is makmkv

thank you.

To confirm what Mainfrezzer found: I checked that IP directly, and it serves the Cloudflare origin certificate for makemkv.com, so it is MakeMKV's own server, not something suspicious. The MakeMKV app connects to it for its update check and to download its keys file.

Your diagnostics also show the same containers, including MakeMKV, were already running before you updated, so the update itself is not the cause. Your server rebooted for the update and restarted all containers, which is why the alerts seemed to start then.

Note that your Ripper container also includes MakeMKV, so either container can make this connection. If you want to stop the alerts, add an allow rule on the firewall for that IP. Or keep the containers stopped when you don't use them.

Nothing in the diagnostics points to a compromise.

thanks everyone. Sorry for the stupid questions.