Skip to main content
jacksonpatton
Contributor I
March 20, 2021
Answered

Sonos Devices Connecting to unsecure IP addresses

I monitor my network traffic and recently received a notification that my Sonos Play 3 was accessing a phishing site at 1:03 AM (a time when the system was not being used). As part of the monitoring I have noticed over time that all my Sonos devices connect to random IP addresses once per hour via port 123 (UDP). It’s my understand this is network time protocol used for synchronization. However after months of monitoring I received the following notification for the first time.

”Device Sonos Play 3 is accessing phishing site 104.236.116.147.“

After further investigation it seems like this IP address (104.236.116.147) has been identified as an unsecured phishing site. I did a Whois search and the domain owner is digital ocean which seems normal for the UDP sync. When navigating to the site via web browser it appears to be a default message saying nginx has been successfully installed.

Has anyone else seen an issue like this or ran into issues with the IP address block 104.236.0.0/16?

    This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.
    ratty
    rattyAnswer
    March 20, 2021

    The address is a hosting provider, but for some reason has apparently made it onto blacklists. Google blocks it as potentially “deceptive” owing to phishing reports.

    There are references to north-america.pool.ntp.org in conjunction with that IP, which seems logical for UDP 123 traffic.

    View in thread

    4 replies

    controlav
    controlav
    Lead Maestro
    March 20, 2021

    What was the Play:3 playing at the time? Sounds like it is probably streaming a url from that address. Do you have the full url it was accessing, or the UDP port number?

    Author of the leading independent Sonos apps for Android, MacOS, iOS, Windows and Xbox.
    jacksonpattonAuthor
    Contributor I
    March 20, 2021

    That’s the strange thing. It was not streaming anything at the time. The Sonos system was not being used. Do not have the url, only the IP listed above and UDP 123.

    ratty
    rattyAnswer
    March 20, 2021

    The address is a hosting provider, but for some reason has apparently made it onto blacklists. Google blocks it as potentially “deceptive” owing to phishing reports.

    There are references to north-america.pool.ntp.org in conjunction with that IP, which seems logical for UDP 123 traffic.

      Stanley_4
      Stanley_4
      Grand Maestro
      March 22, 2021

      You can redirect the Sonos NTP queries to a local NTP server or a different distant one of your choice by tweaking your router’s DNS to IP conversion.

      Terms & ConditionsAccessibility statement