My firewall log shows a bunch of blocked TCP:RA traffic from one of my machines outbound to 91.121.40.124:80, which resolves as web.statseb.fr

That URL has something to do with BOINC signature stats, but I can't figure out what it is or why one of my machines wants to talk to it.

Maybe someone has it in a forum post(s).

When testing that address get

It works!

This is the default web page for this server.

The web server software is running but no content has been added, yet.

The question is, have you identified from where you get this address injected?

---

Coelum Non Animum Mutant, Qui Trans Mare Currunt

My firewall log shows a bunch of blocked TCP:RA traffic from one of my machines outbound to 91.121.40.124:80, which resolves as web.statseb.fr

That URL has something to do with BOINC signature stats, but I can't figure out what it is or why one of my machines wants to talk to it.

Yes can confirm that is the server to the stats signatures. You can see the them here: http://signature.statseb.fr/
It will NOT come from inside the BOINC program/projects, only from "user signatures" in various forum post on ANY of the project boards or possibly from this board where forum signatures ARE allowed.

It should be safe to allow through the firewall.

It should be safe to allow through the firewall.

or you can hide signatures here Forum preferences

Is it the server for signatures on this BOINC forum or that of some project's site? I don't use signatures, so I assume it is trying to pull data for all the other forum participants' own signatures?

Regardless, the real questions are:

1. Why is this traffic originating from a machine that spends its time as a headless domain controller that crunches WUs in its spare time? What application could be triggering this, if not a web browser?

2. Why is this traffic flooding? Example:

Jun 30 02:04:10 LAN Default deny rule IPv4 (1000000103) 192.168.0.50:59589 91.121.40.124:80 TCP:RA
Jun 30 02:03:58
Jun 30 02:03:53
Jun 30 02:03:50
Jun 30 02:03:49
...etc.