I was troubleshooting a network issue and saw in the ss -an output that there was an established connection to 162.255.226.75 on 443/tcp. If I browse to this IP, it is a repository for various linux distributions. A moment later, it was gone.
I do my updates through whonix and I wasn’t running an update at the time. Can someone help explain why that connection was being made?
Reverse DNS for that IP
disabling auto updates in the template might solve this, if it’s based on a debian template.
systemctl disable apt-daily.{service,timer}
That service should already be disabled.
If it isn’t it’s a regression.
More likely this is normal check for updates - you can disable this from
global settings, or using qvm-service on the qubes-update-check
service in individual qubes.