I'm at wits end here. Since yesterday whenever I connect to my router (via Ethernet) svchost tries to connect to some obscure IP. 188.8.131.52. The previous night it never did this and I've not installed anything new, my defense+ and firewall have both been on permanently. Some of it seems to be IPV6 traffic? Strange, some sort of IPV4 tunneling possibly? Also, ignore 184.108.40.206, I'm just blocking Microsoft. Anyway, I did multiple malware scans (malwarebytes, spybot, super-antispyware, Dr. Web) and never found a thing. I also re-imaged my entire system HDD to 3 weeks ago, but the exact same behavior occurs (And it never did so previously). So time to dig deeper... Using TCP View I found the Svchost process attempting the connection. I then moved on to Process Monitor to track the PID and found that the service NIS (Network Store Interface Service) is initiating the connection. So that doesn't help much. DNS lookups seems to direct me to webredir.vip.gandi.net. So I fired up Wireshark. Following the TCP traffic to that address gives me the following string: Going to that domain just results in a parked page, probably something normal (to do with WPAD?). But the link to see info on the parked domain reveals that it was registered on the 26 - just when I started receiving these problems?? Attached are screenshots from Process Monitor and my Comodo firewall log. Also, I'm on Windows 7 64bit SP1.