Workstations trying to GET /download/IEService215.chm HTTP/1.1 fr om 67.109.249.3

["Humes, David G." <David.Humes () jhuapl edu>]

Starting around July 8th we noticed workstations trying to access
67.109.249.3 on port 80 and do a

GET /download/IEService215.chm HTTP/1.1

Analysis of the users' browsing activity did not reveal any pattern that
would suggest that the activity was user-initiated.  We suspect that this is
something trying to "phone home", but not sure quite what.  A reverse lookup
of the IP just returns 67.109.249.3.ptr.us.xo.net, and whois just tells me
that it belongs to XO.  Has anyone else seen this and know what it is?

Thanks.

--Dave