What is nsw.foxtel.net.au and why is it reading data from my hard disk?

Catnip · Feb 20, 2023

Like the title says, nsw.foxtel.net.au is reading a huge amount of data from my hard disk and I don't understand why. I recently installed Macrium Reflect (free version) and this large data exodus seems to be happening when Macrium runs. I am saving my images on a NAS. Why is my data going to Australia? I am confused.

Googling the problem just gives me all sorts of information about Foxtel set top boxes (they seem to be an Australian internet provider) and other services.

If this is what I have to to look forward to from Macrium, it's off my system in a heartbeat.

Does anyone know if there is a correlation here? Or am I just being paranoid?

glasskuter · Feb 20, 2023

nsw.foxtel.net.au is an IP address located in Waterloo, New South Wales, AU that is assigned to Foxtel, an Australian local television program company. It has nothing to do with Macrium if you downloaded Macrium from the official site.
If you do not know how it got on your computer, I suggest you scan for malware with Malwarebytes free. Be sure to quarantine anything MWB finds. Also run scan with Adwcleaner, also free.
Malwarebytes will install the premium version for 14 days. After that time it will automatically revert to the free version. MWB will give you a popup every once in a while trying to get you to buy the premium version but it's not overly intrusive. You can always uninstall it if you want. Just make sure you choose to remove anything it has quarantined before you uninstall it.

Free Antivirus Software 2023 | Download Free Antivirus for Windows, Mac, Android and iOS

Download free antivirus software with 2023 protection for all devices - free antivirus for Windows, Mac, Android, and iOS devices.

www.malwarebytes.com

AdwCleaner 2023 - Free Adware Cleaner & Removal Tool | Malwarebytes

Download Malwarebytes AdwCleaner 2023 for free to remove adware, bloatware, unwanted toolbars, and other potentially unwanted programs (PUPs) from your Windows PC. AdwCleaner destroys adware and restores your PC's performance.

www.malwarebytes.com

kelper · Feb 21, 2023

How do you know it's nsw.foxtel.net.au?

Dwarfr66 · Feb 21, 2023

Yep, its pay TV service here in Australia (owned in part by Rupert Murdock). It's a ripoff.

idgat · Feb 21, 2023

Catnip said:
Like the title says, nsw.foxtel.net.au is reading a huge amount of data from my hard disk

Where are you getting this information from ? Happening constantly? Periodically ?

Where are you located ?

From where did you download Macrium Reflect ?

Catnip · Feb 21, 2023

glasskuter said:
nsw.foxtel.net.au is an IP address located in Waterloo, New South Wales, AU that is assigned to Foxtel, an Australian local television program company. It has nothing to do with Macrium if you downloaded Macrium from the official site.
If you do not know how it got on your computer, I suggest you scan for malware with Malwarebytes free. Be sure to quarantine anything MWB finds. Also run scan with Adwcleaner, also free.
Malwarebytes will install the premium version for 14 days. After that time it will automatically revert to the free version. MWB will give you a popup every once in a while trying to get you to buy the premium version but it's not overly intrusive. You can always uninstall it if you want. Just make sure you choose to remove anything it has quarantined before you uninstall it.

Free Antivirus Software 2023 | Download Free Antivirus for Windows, Mac, Android and iOS

Download free antivirus software with 2023 protection for all devices - free antivirus for Windows, Mac, Android, and iOS devices.

www.malwarebytes.com

AdwCleaner 2023 - Free Adware Cleaner & Removal Tool | Malwarebytes

Download Malwarebytes AdwCleaner 2023 for free to remove adware, bloatware, unwanted toolbars, and other potentially unwanted programs (PUPs) from your Windows PC. AdwCleaner destroys adware and restores your PC's performance.

www.malwarebytes.com

I use MalwareBytes Premium regularly, as well as SuperAntiSpyware. Both turn up nothing.

idgat said:
Where are you getting this information from ? Happening constantly? Periodically ?

Where are you located ?

From where did you download Macrium Reflect ?

I got Reflect from Major Geeks because I wanted the older free version.

I'm in Canada and I am getting the information from Resource Monitor (I blocked out my IP addresses):

It happens as soon as I open Macrium, or when I open my NAS using Windows Explorer (It's a mapped drive). I can't figure this out. What does an Australian internet company have to do with my NAS? It's a D-Link 323 2 bay NAS, and it was made in Taiwan or China. How that relates to Australia, I do not know.

Haydon · Feb 21, 2023

@Catnip Does it happen to another computer on your LAN? Prior to and after installing Macrium Reflect on it?

kelper · Feb 21, 2023

how do you know it is reading? Isn't it more likely that you are streaming radio or video from their website?

glasskuter · Feb 21, 2023

You can block the website or the entire domain using Windows firewall or your hosts file.

How to Block a Domain or Website on Windows Defender Firewall with PowerShell? | Windows OS Hub

Let’s consider some ways to block access to the specific websites, domain names, URLs or IP addresses in Windows without using third-party tools. In our case, we will try to…

woshub.com

Catnip · Feb 21, 2023

Haydon said:
@Catnip Does it happen to another computer on your LAN? Prior to and after installing Macrium Reflect on it?

I have not tried that as of yet. I will give it a try and report back.

kelper said:
how do you know it is reading? Isn't it more likely that you are streaming radio or video from their website?

I am watching hundreds of megabytes of data being read from my system in resource monitor, with very little written to the system. I am not streaming audio or video from the website, I am trying to backup my hard disk(s). The system backup is working, but the data also seems to be going to somewhere in Australia, which based on the sensitive nature of some of the data on my PC is absolutely horrifying.

glasskuter said:
You can block the website or the entire domain using Windows firewall or your hosts file.

How to Block a Domain or Website on Windows Defender Firewall with PowerShell? | Windows OS Hub

Let’s consider some ways to block access to the specific websites, domain names, URLs or IP addresses in Windows without using third-party tools. In our case, we will try to…

woshub.com

Thanks for this link. I looked at it and I might have trouble with it because the string in resource monitor has the IP address of the NAS embedded in it. If I block that IP address, I can't see my NAS. The full address shown in Resource Monitor is "cpe-(NAS IP address).nsw.foxtel.net.au" I am not sure how to block the Foxtel part of the address without blocking the NAS as well. I am not the biggest genius with Powershell or the firewall.

I will fiddle around with it and see what I can accomplish and report back.

idgat · Feb 21, 2023

I suspect this is from another source (i.e. not Foxtel) with either a masked IP, or an error in the detection program .... which in itself is still a bit of a worry in the fact that it's happening.

Are you running any torrent software ?

Under what section/category of Resmon are these details showing ?

(Re-)Check your firewall settings - is there a specific entry allowing this, or an entry that might look unfamiliar (suspicious) ?

Bree · Feb 21, 2023

Catnip said:
I got Reflect from Major Geeks because I wanted the older free version.

You can still get that direct from Macrium if you know the right url to use.

idgat · Feb 21, 2023

Bree said:
You can still get that direct from Macrium if you know the right url to use.

Yes, but Macrium requires (used to?) an email to download. For free software, that's simply a data-collecting spam opportunity excercise.

Much prefer MajorGeeks even if an update (from Macrium) is required on first run. No email ever required.

Bree · Feb 21, 2023

idgat said:
but Macrium requires (used to?) an email to download. For free software, that's simply a data-collecting spam opportunity excercise.

There is no email required for the direct download links. When installing if you select Reflect Free for personal use registration is optional, you are free to un-tick the box for 'Register this installation of Macrium Reflect'. Only if you choose a commercial licence for Reflect Free do you have to provide an email.

Catnip · Feb 22, 2023

Update:

Well, I tried a couple of more computers on my LAN that do not have Macrium installed. As soon as I link to the NAS, Foxtel comes up in the network tab of Resource Monitor. Not as much data flows, it is only a few kilobytes being read, but it still has that Foxtel address.

I am starting to think that this is something with my NAS instead of Macrium. All of the scans are coming back negative for viruses and malware, but when I contact the NAS with any PC on my LAN, up pops Foxtel. I am wondering if my NAS device has been hacked somehow. I am behind a couple of hardware firewalls, but some enterprising scumbag could probably get through them fairly easily.

I am going to check with D-Link and see if I can find out anything about this.

iPanda032 · Feb 22, 2023

I'd look at the NAS Network settings. ANd any other NAS settings to see if anything is checked or set.

Porthos · Feb 22, 2023

Foxtel is also a brand of network equipment.

Bree · Feb 22, 2023

Catnip said:
....The full address shown in Resource Monitor is "cpe-(NAS IP address).nsw.foxtel.net.au"....

Catnip said:
...when I contact the NAS with any PC on my LAN, up pops Foxtel. I am wondering if my NAS device has been hacked somehow.

The most relevant article I can find that includes both cpe and Foxtel is this:

More than 80% of technical issues happen in the home WiFi network behind customer premise equipment (CPE) such as routers and set top boxes. With home WiFi supporting more Internet and smart home devices from various vendors, the impact is being felt on service quality. This means more calls into customer care who aren’t equipped to troubleshoot effectively, and need to escalate to field engineering,” said Ann Hatchell, Chief Marketing Officer at Incognito. “The Digital Home Experience Solution empowers network operations and customer care, and uniquely offers the home user automated troubleshooting paths to easily resolve technical issues. This means happier customers and a significant improvement in operational efficiency.”

About Incognito Software Systems

Incognito Software Systems Inc. provides software and services to help service providers manage and monetize broadband services. Over 300 customers worldwide, including Cox, Claro, Globe, Foxtel, and Singtel, leverage Incognito solutions to fast-track the introduction of innovative broadband services over fiber, LTE, and cable technologies, while delivering a great customer experience

Incognito Launches Digital Home Experience Solution

Incognito Software Systems, a global provider of device and service management solutions for digital service providers, today introduced the Digital H

www.businesswire.com

That seems to suggest that the IP traffic associated with your NAS may be some form of benign(?) telemetry.

Bree · Feb 22, 2023

Catnip said:
Thanks for this link. I looked at it and I might have trouble with it because the string in resource monitor has the IP address of the NAS embedded in it. If I block that IP address, I can't see my NAS. The full address shown in Resource Monitor is "cpe-(NAS IP address).nsw.foxtel.net.au" I am not sure how to block the Foxtel part of the address without blocking the NAS as well.

Use the Host table option from that link. Add this line (using the actual IP address, of course) to your Host file:
127.0.0.1 cpe-(NAS IP address).nsw.foxtel.net.au

This will redirect IP intended for traffic for the Foxtel address to Localhost (ie. your own PC). This will not block access to your NAS. The fact that the full address you'd be blocking contains the IP address of the NAS is irrelevant.

idgat · Feb 22, 2023

Bree said:
There is no email required for the direct download links. When installing if you select Reflect Free for personal use registration is optional, you are free to un-tick the box for 'Register this installation of Macrium Reflect'. Only if you choose a commercial licence for Reflect Free do you have to provide an email.

It was not during the installation that was the concern (at least the user had an option not to register).

It was when attempting to download the installation file from the Macrium website (navigating from the home page > Products/Downloads > etc) that an email was required to be given for the download link (albeit your above direct links don't require such).

The free Home version is no longer available (only a trial version is) from the Macrium website so the whole point is now moot.