Constant network IN traffic -- malware/ hack?

Hi,

I have just noticed that my network interface receives constant traffic. I have turned off the only virtual machine and the only thing I can come up with is with iftop which shows me the following:

87.141.215.251:4000                                              => 232.0.20.35:10000                                                5.20Mb  4.92Mb  4.92Mb
                                                                 <=                                                                     0b      0b      0b

after a while this changed to:

232.0.20.234:10000                                               => 87.141.215.251:4000                                                 0b      0b      0b
                                                                 <=                                                                  6.36Mb  5.98Mb  5.62Mb

both of those IPs are not mine but it seems what is generating the traffic. I am seriously worried and am kindly asking for any help how to find out what is going on here.
Running TrueNAS-13.0-U6.7