Recently I got a meesage from my Norton Internet Security (NIS) that
Outlook is trying to access the internet (ip address 65.196.38.11)
using TCP/IP. My first thoughts were this might be one of my pop3 or
smtp mail servers. To confirm it I checked my mail servers. But their
IP address were different (pop3.attglobal.net -32.97.166.20 and
asmtp.attglobal.net -  32.97.166.50). On further investigation NIS
found that 65.196.38.11 was in Boston and is assigned to one "Sarah
Testing" based Greensboro, NC. I blocked the attempt and there was no
message from MS Outlook.

My questions are - Why MS Outlook was trying to access this server and
why this server ?

I have puzzled over this for a little bit and the only thing that I
can even think of is that you might have recieved an email with a html
link pointing to that ip address... Other than that this is the only
other info I could come up with. You might try contacting the ISP and
asking if this ip address is assigned to a server of some sort or if
this is someones home computer. They might be able to give you some
more info.

CustName:   SARAH TESTING
Address:    4125 WALKER AVE
City:       GREENSBORO
StateProv:  NC
PostalCode: 27407
Country:    US
RegDate:    2002-10-07
Updated:    2003-05-30

NetRange:   65.196.38.0 - 65.196.38.255 
CIDR:       65.196.38.0/24 
NetName:    UU-65-196-38-D6
NetHandle:  NET-65-196-38-0-1
Parent:     NET-65-192-0-0-1
NetType:    Reassigned
Comment:    
RegDate:    2002-10-07
Updated:    2003-05-30

TechHandle: OA12-ARIN
TechName:   UUnet Technologies, Inc., Technologies 
TechPhone:  +1-800-900-0241
TechEmail:  help4u@mci.com 

OrgAbuseHandle: ABUSE3-ARIN
OrgAbuseName:   abuse 
OrgAbusePhone:  +1-800-900-0241
OrgAbuseEmail:  abuse-mail@mci.com

OrgNOCHandle: OA12-ARIN
OrgNOCName:   UUnet Technologies, Inc., Technologies 
OrgNOCPhone:  +1-800-900-0241
OrgNOCEmail:  help4u@mci.com

OrgTechHandle: SWIPP-ARIN
OrgTechName:   swipper 
OrgTechPhone:  +1-800-900-0241
OrgTechEmail:  swipper@uu.net

# ARIN WHOIS database, last updated 2003-06-25 21:05
# Enter ? for additional hints on searching ARIN's WHOIS database.

Map quest info:

http://www.mapquest.com/maps/map.adp?zoom=5&mapdata=nGCyq1371PjrOKBuJLnZZeACho1cWtPN2taKugLzJykL53BjttDFJg5oYwINztZtOpnQ%2burTvZHwpmdbJuWKsuZzh568xTfJpb24IYAdYr5S1Ax1AYwXSoVcJN%2fF9fA6eIjEeyWmq7zmOOe%2fW9U%2fWQZu%2f8uDkP%2fwzY4Etw1vea10RNo0Rj1mwzFzmQpTNmwu0ylnPYQ2x1nCRHkQuwEukyHaT%2bWHe26pXH7D2Zig8FkuHLx4J4fsL9J4FJXOq9SS2TljApI2kb8WPYawF4J9TIShZ4TswcCZdXiiJxhyufEzGDyEK32q5a2LOuHfYRWDrySZZdDUE49kRZ
rh8x2rFOEjm9czcsvTl9sQ%2fpzJK3kIvIfxqDrPQ%3d%3d

I suggest updating Virus defs and scanning for viruses. This sounds
more like a possible trojan horse than random activity. Other than
that, I concur with nathanrice, contact the ISP and ask for more
information on the customer.