I run Sophos UTM 9.705-3 pointing in to an Internal Sink Hole DNS Server.
The first rule of my UTM blocks https to a large number of DNS over HTTPS Servers, one of those DOH Servers is commons[.]host.
As of 00:08 Hrs this morning I am now getting hourly ATP alerts for my DNS Server looking up an IP associated with commons[.]host which seems to now be classified as a C2 address. The IP in question is 198.54.117[.]197 .
I know why the activity takes place, the UTM Server is refreshing the IPs associated with the FQDN specified in my block rule and as it uses an Internal DNS it is catching the lookup from the DNS server.
Is there any way I can stop these alerts in this configuration ?
This thread was automatically locked due to age.
