Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Subscribers 10 subscribers
  • Views 10069 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos ATP DNS dropping *.hwcdn.net domains

rm90

Hi all

We are seeing a lot of dropping from Sophos UTM9 packages (ATP DNS) from *.hwcdn.net.

Someone else?

Examples;


cds.f7y3z2w8.hwcdn.net
cds.d2s7q6s2.hwcdn.net
cds.c4s5i3x5.hwcdn.net

Looks like it is from Windows Update / Microsoft, but some sites telling its malicious, others not.

Also, I found it: https://answers.microsoft.com/en-us/windows/forum/all/are-microsoft-webservices-safe-behind-next-public/b819c103-2cb3-4874-b46e-b375360a3bf6



This thread was automatically locked due to age.
Parents Reply
  • +1 in reply to emmosophos

    Response from Sophos:

    Thank you for reproting this issue.

    We have updated the ATP signature and it should no longer mark 209.197.3.8 as C2 attack. 

    This IP address is used by Microsoft for windows update.

    Please ensure that pattern updates are up to date if you are still facing the same issue. 

Children
Unfiltered HTML