ATP alerts for 192.229.211.108

Others are reporting this:    https://www.reddit.com/r/sophos/comments/12ddqns/an_attempt_to_communicate_with_a_botnet_or/   

We're also seeing tons of ATP alerts that appear to be valid DNS requests to 8.8.8.8 , 1.0.0.3, 208.67.222.222   etc.    

Anyone else?

I've verified that we've been using the same URLs for a year and the same IP since Feb 27. If we're malwared, it's pretty established. 

Digging into the actual log file - all the ATP alerts include the IP you referenced.  192.229.211.108

Hello there,

Good day and thanks for reaching out to Sophos Community and hope you are well. 

This is a FP and IP seems to be used by DigiCert and this is now fixed by Labs at this point of time, IP is no longer blocked by Sophos.

Many thanks for your time and patience and thank you for choosing Sophos

Cheers,