Currently, Syslog-ng Store Box (SSB) uses hardcoded IP Addresses for the High Availability (HA) interfaces:
220.127.116.11 and 18.104.22.168
Unfortunately, these addresses are known public IP addresses from China which is a concern for United States Federal-based customers.
This has been addressed in Syslog-NG Store Box version 6.6.0 via Enhancement Request # SSB-3169.
Detail for releases *prior* to 6.6.0: There is no workaround to change these addresses at this time other than upgrading to 6.6.0.
*NOTE* These IP Addresses are not routable IP Addresses and should therefore pose no security risks.