Thread Info
  • Locked Locked
  • Replies 13 replies
  • Subscribers 14 subscribers
  • Views 5677 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Advanced Threat Detection flagging Akamai

BarryG

Hi, on 9.707, 

e13678.dspb.akamaiedge.net was flagged by the ATP system tonight:

2021:08:28-19:50:28 fw named[5536]: rpz: client 192.168.1.3#57698 (e13678.dscb.akamaiedge.net): view default: rpz QNAME NXDOMAIN rewrite e13678.dscb.akamaiedge.net via e13678.dscb.akamaiedge.net

Since Akamai is normally considered a trustworthy CDN, I need more information. What is the reason the traffic is suspicious?

Thanks,
Barry

(home user and commercial customer)



This thread was automatically locked due to age.
Parents

  • Same here, 9.707-5

    18 ATP alerts since about 07:10 AM (UTC+1), all DNS requests to this specific akamai address.

    2021:08:29-07:10:16 XXX named[9265]: rpz: client XXX.XXX.XXX.XXX#52321 (e13678.dscb.akamaiedge.net): view default: rpz QNAME NXDOMAIN rewrite e13678.dscb.akamaiedge.net via e13678.dscb.akamaiedge.net

    Cheers
    Fab

Reply

  • Same here, 9.707-5

    18 ATP alerts since about 07:10 AM (UTC+1), all DNS requests to this specific akamai address.

    2021:08:29-07:10:16 XXX named[9265]: rpz: client XXX.XXX.XXX.XXX#52321 (e13678.dscb.akamaiedge.net): view default: rpz QNAME NXDOMAIN rewrite e13678.dscb.akamaiedge.net via e13678.dscb.akamaiedge.net

    Cheers
    Fab

Children
No Data
Unfiltered HTML