Although it would seem to be a sniffer, I am embarrassed that the sniffer standing sys-firewall shows that the traffic comes from sys-firewall (not sys-whonix). And the sniffer from sys-net doesn't catch the ping connection to the site. In general, I'll deal with iptabals with if there are any more questions I write.
------------------------------------------ This mail was sent by Confidesk AG`s secure mail service. Check it on http://www.confidesk.com/ -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/E1jNMz0-0004f1-Bw%40chwww1.confidesk.com.