an unusual DNS Over HTTPS (DoH) communication with server 208.67.220.220

[Phillip9ja]

We got an alert from our Cloud provider around a DNS over HTTPS information from one of our VMX-L

You have a GuardDuty Finding Type: DefenseEvasion:EC2/UnusualDoHActivity in the Region: *********

"Description: The EC2 instance ************* is performing an unusual DNS Over HTTPS (DoH) communication with server 208.67.220.220.."

208.67.220.220 - Cisco Open DNS 

Kindly Advise any information related to this info. 

[Brash]

That is the IP address of the OpenDNS/Cisco Umbrella security solution.

It's likely that either a client on your network has the Cisco Secure Connect client with Umbrella module installed, you have an integration with Cisco Umbrella on the MX or you've configured "Use Umbrella" for DNS in one of your DHCP scopes.

[RaphaelL]

I would be curious to know if you are using Umbrella. 

I have an open case ( from 2022... ) that all my MX450s in Concentrator mode are sourcing that type of trafic and we are not using umbrella. I wasn't able to get an answer from Meraki since then.