Management, Networking, Logging and Reporting Malicious?

UTM Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 6 replies
Subscribers 6 subscribers
Views 8166 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Malicious?

Paolo Lat over 6 years ago

Hi There,

Just saw this on our Web Protection > Top Users By Traffic

Any idea why is it showing a long string of lines or possibly a domain instead of an IP?

Is this a compromised machine?

Is this a something that they're trying to access?

Is this the user being on a VPN?

This thread was automatically locked due to age.

Parents

0 Alexander Busch over 6 years ago

This seems just normal resolved domains. It looks like the other IPs are just internal IPs and there is no reverse lookup configured.

Maybe tell us a little more regarding your infrastructure.

Best

Alex

-
Cancel
Vote Up 0 Vote Down

Cancel
0 Paolo Lat over 6 years ago in reply to Alexander Busch

I'm thinking that if this are just resolved domains then that would mean we would have an internal domain like this right? but we don't
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Paolo Lat over 6 years ago in reply to Alexander Busch

I'm thinking that if this are just resolved domains then that would mean we would have an internal domain like this right? but we don't
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 giomoda over 6 years ago in reply to Paolo Lat

Well, they do resolve to external IPs, so I would check your network and UTM configuration for holes. Somehow those hosts are using your web proxy, it appears.

p196235-ipngn200304sinnagasak.nagasaki.ocn.ne.jp. 86381 IN A 180.10.1.235

p196233-ipngn200304sinnagasak.nagasaki.ocn.ne.jp. 86400 IN A 180.10.1.233

Regards,

Giovani
Cancel
Vote Up 0 Vote Down

Cancel