Thread Info
  • State Verified Answer
  • +11 person also asked this people also asked this
  • Locked Locked
  • Replies 37 replies
  • Answers 1 answer
  • Subscribers 38 subscribers
  • Views 21070 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ATP C2/Generic-A Cloudflare 188.114.97.3 ?

Timo Bergmann

Guten Abend,

ist hier etwas dran weshalb Sophos die IP 188.114.97.3 als Malicious einstuft oder wieder ein FalsePositive?

Unser ATP der UTM9 meldet das seit Freitag bei DNS Anfragen ...

 



This thread was automatically locked due to age.
Parents
  • 0

    Die XGs sind ein wenig gesprächiger, scheint mal wieder irgendein Edge-Feature zu sein. Eventuell die automatisch angezeigten Nachrichten?
    Microsoft selbst wird ja vermutlich eher nix bei Cloudflare hosten...

    Regards,

    Kevin

    Sophos CE/CA (XG, UTM, Central Endpoint)
    Gold Partner

  • 0 in reply to kerobra

    Do the following: 
    Filter in logviewer for the IP (use only the string search on the top right site). 
    Then move to the detailed view and check, which URL was opened. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I can only see the URL when searching the IP in the Web filter logs. Over the day the fqdn changed quite a few times...

    And ATP keeps banging on all our firewalls. The UTMs are relatively quiet now, but the XG/XGs are notifying every 10 minutes or so. And additionally Central mails are coming from some customers. We are totally bombed by those mails today...

    Regards,

    Kevin

    Sophos CE/CA (XG, UTM, Central Endpoint)
    Gold Partner

Reply
  • 0 in reply to LuCar Toni

    I can only see the URL when searching the IP in the Web filter logs. Over the day the fqdn changed quite a few times...

    And ATP keeps banging on all our firewalls. The UTMs are relatively quiet now, but the XG/XGs are notifying every 10 minutes or so. And additionally Central mails are coming from some customers. We are totally bombed by those mails today...

    Regards,

    Kevin

    Sophos CE/CA (XG, UTM, Central Endpoint)
    Gold Partner

Children
Unfiltered HTML