Q:

CDNs used by Windows Update

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following.
I'm noticing taffic from our network to the following IP address: 8.26.202.125 . I see from http://robtex.com that this IP address belongs to a CDN provider (Level 3 Communications) and that the IP seems to be used a lot for porn stuff, via rncdn1.com sub-domains among others (see http://www.robtex.com/ip/8.26.202.125.html#ip).
Thinking that I had infected machines in our network (one of the source was a Windows server, and our sysadmins are not addicted to porn!), I fired up Wireshark to find out the contents of the packets. The packets contained what seem to be valid Windows Update requests:
    HEAD /v9/windowsupdate/redir/muv4wuredir.cab?1204161927 HTTP/1.1\r\n
    GET /v9/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab?1204161927
    HTTP/1.1\r\n
    GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\n
    .
    .
    .

I know that these can be good-looking requests that are in fact "bad stuff hidden", but I'm wondering: could this be valid traffic and it's just Microsoft using this CDN for its updates? I find it weird that Microsoft would use a CDN that is also used to serve porn stuff. But then again, we've seen stranger things :-)
Thank you.

A:

According to this interesting technical paper Microsoft do indeed use Level 3 as one of their CDN partners.
As to why Microsoft use someone who also serves porn, they probably don't have a lot of choice. There aren't very many CDNs operating at that kind of level, and most of the customers for that sort of service are porn sites. According to this even more interesting report, YouPorn alone takes up 2% of the Internet's traffic. To Level 3 Microsoft are, relatively speaking, small fry.

