Question help tracing ip address

[bwanaaa]

When my pc starts up, I see a lot of network traffic by 'system' to 162.254.196.68. It eventually calms down but I was concerned. There are no unidentified processes running in task manager (but that doesnt mean much since a rootkit can hide its existence) PC scans clean with malware bytes, eset and hitman pro. I tried to tracert this ip but only get

  1     3 ms     4 ms     5 ms  Fios_Quantum_Gateway.fios-router.home
  2     4 ms     2 ms     3 ms  162.254.196.68


Trace complete.

It was an odd port too, 27101. So how can I track this ip down?

 

[SamirD]

So the tool I usually use is a whois lookup. Domain tools has a good one.

I looked it up and something is definitely not right unless you recognize this company called 'Valve Corporation' in the UK:

IP Location	United Kingdom London Valve Corporation
ASN	AS32590 VALVE-CORPORATION - Valve Corporation, US (registered Mar 08, 2011)
Whois Server	whois.arin.net
IP Address	162.254.196.68

NetRange: 162.254.192.0 - 162.254.199.255
CIDR: 162.254.192.0/21
NetName: VALVE-V4-6
NetHandle: NET-162-254-192-0-1
Parent: NET162 (NET-162-0-0-0-0)
NetType: Direct Assignment
OriginAS: AS32590
Organization: Valve Corporation (VC-2)
RegDate: 2014-05-06
Updated: 2014-05-06
Ref: https://rdap.arin.net/registry/ip/162.254.192.0

OrgName: Valve Corporation
OrgId: VC-2
Address: 10400 NE 4th St, Suite 1400
City: Bellevue
StateProv: WA
PostalCode: 98004
Country: US
RegDate: 2010-11-12
Updated: 2018-01-19
Ref: https://rdap.arin.net/registry/entity/VC-2

OrgNOCHandle: NGANM-ARIN
OrgNOCName: Ngan, Milton
OrgNOCPhone: +1-425-889-9642
OrgNOCEmail:
OrgNOCRef: https://rdap.arin.net/registry/entity/NGANM-ARIN

OrgAbuseHandle: NGANM-ARIN
OrgAbuseName: Ngan, Milton
OrgAbusePhone: +1-425-889-9642
OrgAbuseEmail:
OrgAbuseRef: https://rdap.arin.net/registry/entity/NGANM-ARIN

OrgTechHandle: NGANM-ARIN
OrgTechName: Ngan, Milton
OrgTechPhone: +1-425-889-9642
OrgTechEmail:
OrgTechRef: https://rdap.arin.net/registry/entity/NGANM-ARIN

 

[Lost_in_the_HTTP]

So the tool I usually use is a whois lookup. Domain tools has a good one.

I looked it up and something is definitely not right unless you recognize this company called 'Valve Corporation' in the UK:

Valve Corporation, also known as Valve Software, is an American video game developer, publisher, and digital distribution company headquartered in Bellevue, Washington. It is the developer of the software distribution platform Steam and the Half-Life, Counter-Strike, Portal, Day of Defeat, Team Fortress, Left 4 Dead, and Dota series.
Valve was founded in 1996 by former Microsoft employees Gabe Newell and Mike Harrington. Their debut product, the PC first-person shooter Half-Life, was released in 1998 to critical acclaim and commercial success, after which Harrington left the company. In 2003, Valve launched Steam, which accounted for around half of digital PC game sales by 2011.

Valve Corporation - Wikipedia

en.wikipedia.org

I'm guessing they have a UK site?

 

[SamirD]

If you're in the UK, I would think they have a local mirrors or a cdn (content delivery network).

 

[bwanaaa]

thank you. obviously it's Steam (their client for game purchasing/management) I've kept an eye on this - it still happens. I'm guessing the client updates itself periodically (pretty often actually). I'm in the US so I guess some load balancer is sending it abroad.