31Tem
Why am I seeing SSL events resolve to OpenDNS IPs?
This organization I'm working for uses OpenDNS/Cisco Umbrella. I'm confused as to why I'm seeing requests for SSL traffic resolved to
146.112.255.155
146.112.250.83
146.112.250.64
146.112.250.87
146.112.250.73
Are these sinkholed IP addresses? I thought the blockpage IPs were these ones: https://support.opendns.com/hc/en-us/articles/227986927-What-are-the-Cisco-Umbrella-Block-Page-IP-Addresses-
I guess I'm just confused as to how this whole thing works. I've tried reading the OpenDNS support but it hasn't really answered my questions on the IPs above.