Many connections

Clean install on a Vero 4K+
I have issues with streaming iptv, lots of buffering. I have fiber to the home, my provider is Ilox, in Mexico, my DL is 38+, up is 23+, latency 54.
In order to troubleshoot I installed YAmon on a dd-wrt router, this gives the ability to see, in real time, connections to the internet.
In looking over the reports, I noticed some connections from the Vero, to questionable locations, all on port 123, ntp. Thinking there maybe some form of exploit on the Vero, I elected to flash a new image, the latest, 20200607.img.gz.
Monitoring the yamon report page, I see many connections, made by the vero to, some websites:

Private Network 53 124
Vero Front Bedroom 58849 Private Network 53 124
Vero Front Bedroom 123 Interoute Communications Limited 123 76
Vero Front Bedroom 50952 Private Network 53 126
Vero Front Bedroom 51593 Latvian Mobile Telephone 80 727
Vero Front Bedroom 52915 Private Network 53 124
Vero Front Bedroom 57812 Bell Canada 80 723
Vero Front Bedroom 51596 Latvian Mobile Telephone
Vero Front Bedroom 51495 Private Network 53 124
Vero Front Bedroom 59697 Private Network 53 120
Vero Front Bedroom 58625 80 713
Vero Front Bedroom 57808 Bell Canada 80 702
Vero Front Bedroom 39330 Private Network 53 124
Vero Front Bedroom 47082 Private Network 53 122
Vero Front Bedroom 35524 Private Network 53 126
Vero Front Bedroom 36867 80 2029
Vero Front Bedroom 57811 Bell Canada 80 709
Vero Front Bedroom 36254 Private Network 53 122
Vero Front Bedroom 53346 Private Network 53 124
Vero Front Bedroom 41210 Private Network 53 120
Vero Front Bedroom 57810 Bell Canada 80 707
Vero Front Bedroom 60258 80 718
Vero Front Bedroom 57807 Bell Canada 80 700
Vero Front Bedroom 57809 Bell Canada 80 716
Vero Front Bedroom 60259 80 2354
Vero Front Bedroom 52447 Private Network 53 124
Vero Front Bedroom 58849 Private Network 53 124
Vero Front Bedroom 50952 Private Network 53 126
Vero Front Bedroom 123 123 76
Vero Front Bedroom 51593 Latvian Mobile Telephone 80 727
Vero Front Bedroom 52915 Private Network 53 124
Vero Front Bedroom 57812 Bell Canada 80 723
Vero Front Bedroom 51596 Latvian Mobile Telephone 80
Vero Front Bedroom 123 Tefincom S.A.

Again, this is a clean, fresh install, as of today, June 25, 2020
Pointers appreciated

here is an image of the IP addresses:


thanks

and another:
https://imgur.com/gallery/ctiL0gO

I would guess that you have open ports on your router. Check the routers configuration.

a shutdown of the vero results in the above connections, goes away. No connections to the listed addresses.
A direct question, maybe Sam will chime in.
Why are these connections to some foreign server, unrequested, unwanted, no addons installed,on a fresh install of OSMC occuring? The md5sum checks as correct, what else is to be suspect, other than some nefarious action. Do you recognize the IP’s? Is this something that you condone, and allow? Rather than speculate as to what MAYBE the issue, answer the above questions, or not. Of course the router has an open port, how else would you expect to receive the correct time.

What makes you think that they are not valid NTP servers?

I mean open ports to your network. Like port 22 (SSH) being open.

Here ya Go!:
199.233.236.226
QuickPacket, LLC QP-IPV4-2 (NET-199-233-232-0-1) 199.233.232.0 - 199.233.239.255
QuickPacket, LLC QP-IPV4-LAX (NET-199-233-236-0-1) 199.233.236.0 - 199.233.239.255

62.149.0.30
NetRange: 62.0.0.0 - 62.255.255.255
CIDR: 62.0.0.0/8
NetName: RIPE-C3
NetHandle: NET-62-0-0-0-1
Parent: ()
NetType: Allocated to RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate: 1997-04-24
Updated: 2009-03-25
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
Ref: https://rdap.arin.net/registry/ip/62.0.0.0

ResourceLink: https://apps.db.ripe.net/search/query.html
ResourceLink: whois.ripe.net

OrgName: RIPE Network Coordination Centre
OrgId: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
RegDate:
Updated: 2013-07-29
Ref: https://rdap.arin.net/registry/entity/RIPE

ReferralServer: whois://whois.ripe.net
ResourceLink: https://apps.db.ripe.net/search/query.html

OrgTechHandle: RNO29-ARIN
OrgTechName: RIPE NCC Operations
OrgTechPhone: +31 20 535 4444
OrgTechEmail: hostmaster@ripe.net
OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName: Abuse Contact
OrgAbusePhone: +31205354444
OrgAbuseEmail: abuse@ripe.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN

147.156.7.50
NetRange: 147.156.0.0 - 147.156.255.255
CIDR: 147.156.0.0/16
NetName: RIPE-ERX-147-156-0-0
NetHandle: NET-147-156-0-0-1
Parent: NET147 (NET-147-0-0-0-0)
NetType: Early Registrations, Transferred to RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate: 2003-10-08
Updated: 2003-10-08
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
Ref: https://rdap.arin.net/registry/ip/147.156.0.0

ResourceLink: https://apps.db.ripe.net/search/query.html
ResourceLink: whois.ripe.net

OrgName: RIPE Network Coordination Centre
OrgId: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
RegDate:
Updated: 2013-07-29
Ref: https://rdap.arin.net/registry/entity/RIPE

ReferralServer: whois://whois.ripe.net
ResourceLink: https://apps.db.ripe.net/search/query.html

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName: Abuse Contact
OrgAbusePhone: +31205354444
OrgAbuseEmail: abuse@ripe.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName: RIPE NCC Operations
OrgTechPhone: +31 20 535 4444
OrgTechEmail: hostmaster@ripe.net
OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN

193.227.197.2
NetRange: 193.0.0.0 - 193.255.255.255
CIDR: 193.0.0.0/8
NetName: RIPE-CBLK
NetHandle: NET-193-0-0-0-1
Parent: ()
NetType: Allocated to RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate: 1992-08-11
Updated: 2009-03-25
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
Ref: https://rdap.arin.net/registry/ip/193.0.0.0

ResourceLink: https://apps.db.ripe.net/search/query.html
ResourceLink: whois.ripe.net

OrgName: RIPE Network Coordination Centre
OrgId: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
RegDate:
Updated: 2013-07-29
Ref: https://rdap.arin.net/registry/entity/RIPE

ReferralServer: whois://whois.ripe.net
ResourceLink: https://apps.db.ripe.net/search/query.html

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName: Abuse Contact
OrgAbusePhone: +31205354444
OrgAbuseEmail: abuse@ripe.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName: RIPE NCC Operations
OrgTechPhone: +31 20 535 4444
OrgTechEmail: hostmaster@ripe.net
OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN

144.72.126.201 General Motors, Interesting

NetRange: 144.72.0.0 - 144.72.255.255
CIDR: 144.72.0.0/16
NetName: GMSTTH
NetHandle: NET-144-72-0-0-1
Parent: NET144 (NET-144-0-0-0-0)
NetType: Direct Assignment
OriginAS:
Organization: General Motors LLC (GMED)
RegDate: 1990-11-16
Updated: 2014-03-27
Ref: https://rdap.arin.net/registry/ip/144.72.0.0

OrgName: General Motors LLC
OrgId: GMED
Address: 200 Renaissance Center
City: Detroit
StateProv: MI
PostalCode: 48265
Country: US
RegDate: 1990-11-16
Updated: 2017-08-20
Ref: https://rdap.arin.net/registry/entity/GMED

OrgAbuseHandle: GCD2-ARIN
OrgAbuseName: GM Cyber Defense
OrgAbusePhone: +1-224-377-9633
OrgAbuseEmail: abuse@gm.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/GCD2-ARIN

OrgNOCHandle: MER41-ARIN
OrgNOCName: Rudnick, Micki E.
OrgNOCPhone: +1-248-303-5079
OrgNOCEmail: micki.rudnick@gm.com
OrgNOCRef: https://rdap.arin.net/registry/entity/MER41-ARIN

OrgTechHandle: KARUP2-ARIN
OrgTechName: Karuppannan, Venkatachalam
OrgTechPhone: +1-313-667-2256
OrgTechEmail: venkatachalam.karuppannan@gm.com
OrgTechRef: https://rdap.arin.net/registry/entity/KARUP2-ARIN

RAbuseHandle: GCD2-ARIN
RAbuseName: GM Cyber Defense
RAbusePhone: +1-224-377-9633
RAbuseEmail: abuse@gm.comNetRange: 144.72.0.0 - 144.72.255.255
CIDR: 144.72.0.0/16
NetName: GMSTTH
NetHandle: NET-144-72-0-0-1
Parent: NET144 (NET-144-0-0-0-0)
NetType: Direct Assignment
OriginAS:
Organization: General Motors LLC (GMED)
RegDate: 1990-11-16
Updated: 2014-03-27
Ref: https://rdap.arin.net/registry/ip/144.72.0.0

OrgName: General Motors LLC
OrgId: GMED
Address: 200 Renaissance Center
City: Detroit
StateProv: MI
PostalCode: 48265
Country: US
RegDate: 1990-11-16
Updated: 2017-08-20
Ref: https://rdap.arin.net/registry/entity/GMED

OrgAbuseHandle: GCD2-ARIN
OrgAbuseName: GM Cyber Defense
OrgAbusePhone: +1-224-377-9633
OrgAbuseEmail: abuse@gm.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/GCD2-ARIN

OrgNOCHandle: MER41-ARIN
OrgNOCName: Rudnick, Micki E.
OrgNOCPhone: +1-248-303-5079
OrgNOCEmail: micki.rudnick@gm.com
OrgNOCRef: https://rdap.arin.net/registry/entity/MER41-ARIN

OrgTechHandle: KARUP2-ARIN
OrgTechName: Karuppannan, Venkatachalam
OrgTechPhone: +1-313-667-2256
OrgTechEmail: venkatachalam.karuppannan@gm.com
OrgTechRef: https://rdap.arin.net/registry/entity/KARUP2-ARIN

RAbuseHandle: GCD2-ARIN
RAbuseName: GM Cyber Defense
RAbusePhone: +1-224-377-9633
RAbuseEmail: abuse@gm.com
RAbuseRef: https://rdap.arin.net/registry/entity/GCD2-ARIN

RTechHandle: PPI12-ARIN
RTechName: Pipolo, Paulo
RTechPhone: +1-313-667-8876
RTechEmail: paulo.pipolo@gm.com
RTechRef: https://rdap.arin.net/registry/entity/PPI12-ARIN
RAbuseRef: https://rdap.arin.net/registry/entity/GCD2-ARIN

RTechHandle: PPI12-ARIN
RTechName: Pipolo, Paulo
RTechPhone: +1-313-667-8876
RTechEmail: paulo.pipolo@gm.com
RTechRef: https://rdap.arin.net/registry/entity/PPI12-ARIN

138.68.183.79
NetRange: 138.68.0.0 - 138.68.255.255
CIDR: 138.68.0.0/16
NetName: DIGITALOCEAN-138-68-0-0
NetHandle: NET-138-68-0-0-1
Parent: NET138 (NET-138-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS14061
Organization: DigitalOcean, LLC (DO-13)
RegDate: 2016-01-26
Updated: 2020-04-03
Comment: Routing and Peering Policy can be found at https://www.as14061.net
Comment:
Comment: Please submit abuse reports at https://www.digitalocean.com/company/contact/#abuse
Ref: https://rdap.arin.net/registry/ip/138.68.0.0

OrgName: DigitalOcean, LLC
OrgId: DO-13
Address: 101 Ave of the Americas
Address: 10th Floor
City: New York
StateProv: NY
PostalCode: 10013
Country: US
RegDate: 2012-05-14
Updated: 2019-02-04
Comment: http://www.digitalocean.com
Comment: Simple Cloud Hosting
Ref: https://rdap.arin.net/registry/entity/DO-13

OrgAbuseHandle: ABUSE5232-ARIN
OrgAbuseName: Abuse, DigitalOcean
OrgAbusePhone: +1-347-875-6044
OrgAbuseEmail: abuse@digitalocean.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE5232-ARIN

OrgTechHandle: NOC32014-ARIN
OrgTechName: Network Operations Center
OrgTechPhone: +1-347-875-6044
OrgTechEmail: noc@digitalocean.com
OrgTechRef: https://rdap.arin.net/registry/entity/NOC32014-ARIN

OrgNOCHandle: NOC32014-ARIN
OrgNOCName: Network Operations Center
OrgNOCPhone: +1-347-875-6044
OrgNOCEmail: noc@digitalocean.com
OrgNOCRef: https://rdap.arin.net/registry/entity/NOC32014-ARIN

91.236.251.62

NetRange: 91.0.0.0 - 91.255.255.255
CIDR: 91.0.0.0/8
NetName: 91-RIPE
NetHandle: NET-91-0-0-0-1
Parent: ()
NetType: Allocated to RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate: 2005-06-29
Updated: 2009-05-18
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
Ref: https://rdap.arin.net/registry/ip/91.0.0.0

ResourceLink: https://apps.db.ripe.net/search/query.html
ResourceLink: whois.ripe.net

OrgName: RIPE Network Coordination Centre
OrgId: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
RegDate:
Updated: 2013-07-29
Ref: https://rdap.arin.net/registry/entity/RIPE

ReferralServer: whois://whois.ripe.net
ResourceLink: https://apps.db.ripe.net/search/query.html

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName: Abuse Contact
OrgAbusePhone: +31205354444
OrgAbuseEmail: abuse@ripe.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName: RIPE NCC Operations
OrgTechPhone: +31 20 535 4444
OrgTechEmail: hostmaster@ripe.net
OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN

168.96.251.195

NetRange: 168.96.0.0 - 168.96.255.255
CIDR: 168.96.0.0/16
NetName: LACNIC-ERX-168-96-0-0
NetHandle: NET-168-96-0-0-1
Parent: NET168 (NET-168-0-0-0-0)
NetType: Transferred to LACNIC
OriginAS:
Organization: Latin American and Caribbean IP address Regional Registry (LACNIC)
RegDate: 2003-08-20
Updated: 2007-12-17
Comment: This IP address range is under LACNIC responsibility
Comment: for further allocations to users in LACNIC region.
Comment: Please see http://www.lacnic.net/ for further details,
Comment: or check the WHOIS server located at http://whois.lacnic.net
Ref: https://rdap.arin.net/registry/ip/168.96.0.0

ResourceLink: http://lacnic.net/cgi-bin/lacnic/whois
ResourceLink: whois.lacnic.net

OrgName: Latin American and Caribbean IP address Regional Registry
OrgId: LACNIC
Address: Rambla Republica de Mexico 6125
City: Montevideo
StateProv:
PostalCode: 11400
Country: UY
RegDate: 2002-07-26
Updated: 2018-03-15
Ref: https://rdap.arin.net/registry/entity/LACNIC

ReferralServer: whois://whois.lacnic.net
ResourceLink: http://lacnic.net/cgi-bin/lacnic/whois

OrgTechHandle: LACNIC-ARIN
OrgTechName: LACNIC Whois Info
OrgTechPhone: +598-2604-2222
OrgTechEmail: whois-contact@lacnic.net
OrgTechRef: https://rdap.arin.net/registry/entity/LACNIC-ARIN

OrgAbuseHandle: LWI100-ARIN
OrgAbuseName: LACNIC Whois Info
OrgAbusePhone: +598-2604-2222
OrgAbuseEmail: abuse@lacnic.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/LWI100-ARIN

46.165.252.57
NetRange: 46.0.0.0 - 46.255.255.255
CIDR: 46.0.0.0/8
NetName: 46-RIPE
NetHandle: NET-46-0-0-0-0
Parent: ()
NetType: Allocated to RIPE NCC
OriginAS:
Organization: RIPE Network Coordination Centre (RIPE)
RegDate: 2009-09-28
Updated: 2009-09-30
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
Ref: https://rdap.arin.net/registry/ip/46.0.0.0

ResourceLink: https://apps.db.ripe.net/search/query.html
ResourceLink: whois.ripe.net

OrgName: RIPE Network Coordination Centre
OrgId: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
RegDate:
Updated: 2013-07-29
Ref: https://rdap.arin.net/registry/entity/RIPE

ReferralServer: whois://whois.ripe.net
ResourceLink: https://apps.db.ripe.net/search/query.html

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName: Abuse Contact
OrgAbusePhone: +31205354444
OrgAbuseEmail: abuse@ripe.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName: RIPE NCC Operations
OrgTechPhone: +31 20 535 4444
OrgTechEmail: hostmaster@ripe.net
OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN

202.22.158.31
NetRange: 202.0.0.0 - 202.255.255.255
CIDR: 202.0.0.0/8
NetName: APNIC-CIDR-BLK
NetHandle: NET-202-0-0-0-1
Parent: ()
NetType: Allocated to APNIC
OriginAS:
Organization: Asia Pacific Network Information Centre (APNIC)
RegDate: 1994-04-04
Updated: 2010-08-02
Comment: This IP address range is not registered in the ARIN database.
Comment: For details, refer to the APNIC Whois Database via
Comment: WHOIS.APNIC.NET or http://wq.apnic.net/apnic-bin/whois.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment: for the Asia Pacific region. APNIC does not operate networks
Comment: using this IP address range and is not able to investigate
Comment: spam or abuse reports relating to these addresses. For more
Comment: help, refer to http://www.apnic.net/apnic-info/whois_search2/abuse-and-spamming
Ref: https://rdap.arin.net/registry/ip/202.0.0.0

ResourceLink: http://wq.apnic.net/whois-search/static/search.html
ResourceLink: whois.apnic.net

OrgName: Asia Pacific Network Information Centre
OrgId: APNIC
Address: PO Box 3646
City: South Brisbane
StateProv: QLD
PostalCode: 4101
Country: AU
RegDate:
Updated: 2012-01-24
Ref: https://rdap.arin.net/registry/entity/APNIC

ReferralServer: whois://whois.apnic.net
ResourceLink: http://wq.apnic.net/whois-search/static/search.html

OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3188
OrgTechEmail: search-apnic-not-arin@apnic.net
OrgTechRef: https://rdap.arin.net/registry/entity/AWC12-ARIN

OrgAbuseHandle: AWC12-ARIN
OrgAbuseName: APNIC Whois Contact
OrgAbusePhone: +61 7 3858 3188
OrgAbuseEmail: search-apnic-not-arin@apnic.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/AWC12-ARIN

so, is this really necesary? on a fresh install?

You haven’t asnswered the question. Why do you think that they are not valid NTP servers?

According to https://www.pool.ntp.org/zone/north-america, there are 648 active servers for the North America region

well, how many time servers are needed, to correct the time? Do I REALLY need 648 time servers?
Instead of DUCKING my original, valid question, answer it.
Are THESE legitimate servers, authorized by OSMC, and REQUIRED to function.

so, this is a TIME sever, interesting

I don’t think anyone is ducking questions.

What makes these connections questionable?

If they’re on Port 123 - they will be NTP outbound connections. I’m assuming you haven’t port forwarded SSH and your system isn’t compromised.

You can disable NTP and rely on HTTP time instead, which is set once per boot, but this will drift and as NTP will no longer be running, this will could drift out significantly unless you reboot periodically.

You could also reconfigure NTP to use a trusted server of your choice.

A number of time servers are used to prevent single servers from becoming overloaded and facilitate redundancy. Even with our user base, if we pushed 1.5 million users over to a single NTP server, we could cause problems for someone else’s infrastructure.

do a search on ntp exploits
As stated in my original post, there is buffering, for NO apparent reason, other than ISP created issues, data caps, or throttling.
Would you not question, seeing unrequested, unwanted connections, on a fresh install, to some foreign address?
Come on.

NTP exploits typically occur on the client side due to a bug in the daemon, but we deliver security updates and our distributed version of ntpd does not have any known, active exploits. The NTP pools we use are trusted and used by millions of users. They are used by Debian and Ubuntu users.

Any OS is going to have outbound traffic, even on a fresh installation.

The amount of bandwidth that NTP will use is extremely minimal. It would not be responsible for buffering.

You may wish to disable NTP or change the servers used to ones that are less ‘foreign’ or ones that you trust particularly. You could also just block outbound traffic on port 123 on your router, but this could have consequences for other devices that do not have a fallback mechanism for resolving time, such as some CCTV cameras.

so, Sam, your saying ALL of the IP addresses, that I have submitted, are related to NTP time config?
Do I have that correct?

Unless you have port forwarded your device or made any changes to the system, all Port 123 traffic will be to NTP servers.

As you haven’t uploaded any logs, it’s not possible for us to check if you have made any changes or look for obvious signs of intrusion.

well, at this point in time, I choose to NOT allow ANY VERO product to connect to MY net work, you have failed to adequately address the issues I have raised, that are, in my mind valid and reasonable.
Why, for example, must there be a connection to a General Motors website, do they provide a time service? What service is provided, that OSMC relies on? What other data is harvested?
You have not explained any connection to ANY of the IP addresses.

The IP addresses you have posted are NTP time servers. They are not websites.

You can disable the NTP time service completely if you wish to do so and I can provide instructions.

Alternatively, I can provide instructions for how to use an NTP server of your choosing. I don’t know if your ISP provide one specifically. You could use mx.pool.ntp.org - but this involves a pool of servers so there would be multiple IP addresses.

No personal data is collected, because no such data is sent. Your system is simply asking for the time and getting a response.

Hopefully this clarifies the use of those IP addresses and why you see traffic to them as well as your options. You can learn more about NTP with the summary here: https://en.m.wikipedia.org/wiki/Network_Time_Protocol

Sam

Of the large list you posted above, only two do not respond. (NTP servers can be anywhere and are often provided by individual volunteers. There is no guarantee that an NTP server will be online, which is why there are so many.)

smc@osmc:~$ ntpdate -q 193.30.120.245
server 193.30.120.245, stratum 2, offset -0.005095, delay 0.10966
25 Jun 19:29:04 ntpdate[19404]: adjust time server 193.30.120.245 offset -0.005095 sec
osmc@osmc:~$ ntpdate -q 199.233.236.226
server 199.233.236.226, stratum 2, offset -0.010820, delay 0.23102
25 Jun 19:31:29 ntpdate[19409]: adjust time server 199.233.236.226 offset -0.010820 sec
osmc@osmc:~$ ntpdate -q 62.149.0.30
server 62.149.0.30, stratum 1, offset -0.008925, delay 0.11145
25 Jun 19:32:34 ntpdate[19415]: adjust time server 62.149.0.30 offset -0.008925 sec
osmc@osmc:~$ ntpdate -q 147.156.7.50
server 147.156.7.50, stratum 2, offset -0.005240, delay 0.12370
25 Jun 19:33:37 ntpdate[19417]: adjust time server 147.156.7.50 offset -0.005240 sec
osmc@osmc:~$ ntpdate -q 193.227.197.2
server 193.227.197.2, stratum 2, offset -0.008275, delay 0.12508
25 Jun 19:34:23 ntpdate[19422]: adjust time server 193.227.197.2 offset -0.008275 sec
osmc@osmc:~$ ntpdate -q 144.72.126.201
server 144.72.126.201, stratum 0, offset 0.000000, delay 0.00000
25 Jun 19:35:21 ntpdate[19423]: no server suitable for synchronization found
osmc@osmc:~$ ntpdate -q 138.68.183.79
server 138.68.183.79, stratum 0, offset 0.000000, delay 0.00000
25 Jun 19:36:24 ntpdate[19424]: no server suitable for synchronization found
osmc@osmc:~$ ntpdate -q 91.236.251.62
server 91.236.251.62, stratum 2, offset -0.007583, delay 0.12474
25 Jun 19:37:18 ntpdate[19430]: adjust time server 91.236.251.62 offset -0.007583 sec
osmc@osmc:~$ ntpdate -q 168.96.251.195
server 168.96.251.195, stratum 2, offset -0.010701, delay 0.35254
25 Jun 19:38:00 ntpdate[19436]: adjust time server 168.96.251.195 offset -0.010701 sec
osmc@osmc:~$ ntpdate -q 46.165.252.57
server 46.165.252.57, stratum 2, offset -0.004090, delay 0.09526
25 Jun 19:38:39 ntpdate[19437]: adjust time server 46.165.252.57 offset -0.004090 sec
osmc@osmc:~$ ntpdate -q 202.22.158.31
server 202.22.158.31, stratum 2, offset 0.021171, delay 0.44722
25 Jun 19:39:18 ntpdate[19442]: adjust time server 202.22.158.31 offset 0.021171 sec

So your list of addresses actually demonstrates that all but two are valid NTP servers. The other two could be offline for many reasons.