Skynet Help needed to understand: Skynet blocks suspicious IPs but they're not showing up in the firewall log on Mac. Am I hacked?

[torstein]

I need some help to understand what is going on. Also I'm sorry, I'm sure you get tons of these posts, but this is worrying me.

TL;DR
Skynet blocks outbound connections to certain IPs in asia. These IPs don't show up in the firewall network monitor app I'm using on the mac to find out which app / process is phoning home to asia . Why can I not see the skynet blocked IP in the network monitor?

DETAILED DESCRIPTION:
Skynet has blocked these two outbound connections: 136.169.169.164 (Alienvault link) and 103.136.72.6 (Alienvault link). One from russia and one from india.

Indian IP blocked:
Alienvault has tags such as honeypot, malicious ip, botnet etc
WHOIS says it is a company called Navkar Netsol Private Ltd. I'm not sure what it does, it has something to do with industrial stuff, but its not very clear.

Russian IP blocked:
Alienvault has no tags
WHOIS says its UFAnet.ru which seems to be an ISP, but im not sure.

I've seen many weird IPs blocked from my mac mini which serves only as a media server through smb to my apple tv, and time machine bakups and backblaze cloud backup. That's it. No other software running on it. I decided to install Radio Silence firewall for mac to monitor which app or system process that is phoning home. I reset Skynet, and started monitoring. 1 hour later the two mentioned IP addresses show up in Skynet under blocked outbound IP from the mac mini, but the IPs don't show up in Radio Silence.

1. Why is my mac mini time machine and media server phoning home to a russian ISP and an indian industrial company that is marked as botnet and honeypot, and why can't Radio Silence firewall see them, only Skynet?
2. Is skynet blocking them before the firewall can see them, and what can I do about it?
3. AiProtect reports zero blocks
4. Is my mac mini part of a botnet?
5. I've seen random outbound blocks to norhtern asia and central asia, some even to alibaba ltd which makes no sense, as I've never visited the alibaba webpage (asian amazon.com alternative). And its only my mac mini media / backup server that's getting blocked by Skynet.
6. Is the mac mini hacked?

​

 

[dave14305]

Post the actual Skynet OUTBOUND log messages. What ports, source IP, etc. to understand what you’re talking about.

Maybe iCloud private relay in your signature is routing things all around the world for privacy reasons.

 

[torstein]

Post the actual Skynet OUTBOUND log messages. What ports, source IP, etc. to understand what you’re talking about.

Maybe iCloud private relay in your signature is routing things all around the world for privacy reasons.

iCloud Private Relay is not operating on that mac, so it's unaffected.

Can I get the actual skynet outbound log messages from the gui or is it only from the terminal?

 

[Tech9]

You just move through different stages of your blocking obsession and under attack fears. How many threads you are going to create? This is what Skynet does best when used without good understanding how it actually works - to freak you out. Deal with it now - it was your choice to walk this path.

 

[torstein]

@Tech9 Different threads, slightly different questions, but I agree, this one is similar to the previous one. It's not a blocking obsession, it's more of a "novice's obsession". I want to understand what is going on, and learn why it's happening. The previous thread didn't really answer my questions, just you teasing me about stages of router blocking obsessions. Indeed very fun and I like your sense of humor, it hit home, but it didn't help solving the issue, neither did the other responses.

Looking back today with a rested head, I completely agree, I shouldn't have made yet another thread about this particular issue. It was unecessary, and I should have continued the previous one. It was a different set of IP's being blocked, but nonetheless similar issue. If I could delete this thread, I would, but there is no such option.

Having said that, aren't you curious yourself why your computers make the connection they do to servers around the world, connections they shouldn't do? Like, why would a computer with no web browsers, just backup software running connect to i.e. india? You're right, I chose this path, but the consequences are that I have more questions. I wish there was a place to learn about it. There aren't any documentation for Skynet for instance.

Anyhow. I'll be more careful with what threads I start, and try to continue the ones that is in the ballpark of what I want to ask.