It Does Not matter what the "WHOIS" says or what the IP's are....blah, blah.......for example, 63.135.2.250 belongs to a block of 63.135.0.0 - 63.135.31.255...an entire ISP (most likely)....The Specific PORTS are what matters. Check for installed Apps on the Ports and Protocols I listed then go over you logs and look for Handshakes, Authentication, and Outgoing Traffic as well.........