This can always depend, but I noticed the same thing. I hope this will be of help to others out there.
In my situation Little Snitch was asking for access to 195.222.17.38 & port 7024 UDP (vmsvc)
Now is you did a Whois search with the wrong database, it will show the netherlands as a server address, but as it is a European address I did one other quick search using the correct Whois database which is ripe.net
In my case it was Kaspersky which I use as my Windows Security Suite, and below is the Whois info for that Ip Address Request
------------------------------------------------------------------------------------------------------
Whois has started ...
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See
http://www.ripe.net/db/support/db-terms-conditions.pdf
% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '195.222.17.32 - 195.222.17.63'
inetnum: 195.222.17.32 - 195.222.17.63
netname: EE-KASPERSKY-HOUSING
descr: Kaspersky Lab ZAO
descr: Geroev Panfilovtsev 10
descr: 125363 Moccow
country: EE
admin-c: SF1624-RIPE
tech-c: SF1624-RIPE
status: ASSIGNED PA
mnt-by: AS3327-MNT
source: RIPE # Filtered
person: Sergey Fomin
address: System Administrator /Kaspersky Lab Ltd
address: 10, Geroyev Panfilovtsev Str.,
address: 123363, Moscow, Russia
phone: +7 495 797 87 00
phone: +7 495 797 87 07
fax-no: +7 495 797 87 00
nic-hdl: SF1624-RIPE
abuse-mailbox:
abuse@kaspersky.com
mnt-by: MACOMNET-MNT
source: RIPE # Filtered
% Information related to '195.222.0.0/19AS3327'
route: 195.222.0.0/19
descr: Data Telecom, 195.222.0/19
origin: AS3327
mnt-by: AS3327-MNT
source: RIPE # Filtered
------------------------------------------------------------------------------------------------------
