For what's it's worth, I have 900+ deployed in the field, all sending their logs to a central server. I just did a search for the past 30 days and couldn't find any reference to 109.251.192.80. We also have all management services locked down to specific IPs. Either way I still would have seen a log...