Search:

Yeap

vi /lib/systemd/system/greenbone-security-assistant.service

Found the offending IP address.

I've just hit this, fairly sure it is trying to use systemd to restart greenbone-security-assistant, when I was expecting it to run /etc/init.d/greenbone-security-assistant

Now I'll have to reread...