We have created this post as we have seen the IP addresses 220.127.116.11 and 18.104.22.168 been reported as potentially malicious. We have seen ICMP traffic from Windows machines going to these two addresses.
At the time of publication both addresses resolve to the hostname – map2.hwcdn.net
We have found that they belong to High Windows Network Group, owned by StachPath, part of the High Winds Content Delivery Network.
They deliver content for Valve, Facebook LiveRail, BlipTV, Hudl, and other services, like advertising content. They have servers all across the world.
This Microsoft document indicates that they use the hostname hwcdn.net for Windows updates.