The guy in the back looks like he’s sniffing.

140.82.121.5

Well, apparently, this is an A record for api.github.com. This name resolves to a different IP around the globe. See https://www.whatsmydns.net/#A/api.github.com

The IP is detected as “clean” on VirusTotal: https://www.virustotal.com/gui/ip-address/140.82.121.5/detection , although apparently (probably not surprising as it is github) is also a favorite address for everything including malware.

Maybe you can ask in the keepassxc discussion forum on github.

VirusTotal doesn’t indicate keepassxc.exe 2.7.7 contacts this address. I’d be careful. Check the binaries’ signatures. Try a full install to see if that behaves differently.

keppassxc.exe: https://www.virustotal.com/gui/file/fea4df5024f83155f6742a3372a801fc6cc97ed82627b36fce6f0caed54506cf/relations

KeePassXC-2.7.7-Win64.msi: https://www.virustotal.com/gui/file/9c3dab957db0f769c4e67bfdf4f0134a65ecfa65c5569718a36aa88e649158cd

I can’t wait until they start delivering packages with humanoid robots… They could spike up Halloween.

haveibeenpwned:

Oh no — pwned! This password has been seen 726 times before

This password has previously appeared in a data breach and should never be used. If you’ve ever used it anywhere before, change it!

Apparently unrelenting DDOS attack, possibly because they defederated from some instances.