I blocked 18.104.22.168 - 22.214.171.124 about a year ago.
Running 8.28.16. as a cnet search on robtex returned bluecoat cache - perhaps that's it? It included at least a couple of webprotection dot com domains (robtex returns only samples so your test may differ from mine). It may be worth doing a full DNS lookup on all IPs in that range if you're worried but for me the 126.96.36.199/23 block suffices. As far as I'm concerned it's a virus protection "bot".