Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 23 replies
  • Subscribers 3 subscribers
  • Views 384815 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

QNAP NAS triggering C2/Generic-A

MarCow
Hi,

I have a QNAP NAS device on my network, and over the last couple of months (possibly since the upgrade to UTM 9.2 although I'm not 100% sure of that correlation) I've been getting intermittent C2/Generic-A notifications from the UTM Advanced Threat Protection service with the QNAP as the source IP.  The destination IP associated with this warning is 95.211.192.195, which a reverse lookup shows as lw45.ua-hosting.com.ua (apparently a Ukrainian web hosting company).

For now I'm just ignoring these warnings and letting the UTM drop this traffic, but I was curious if anyone else has seen this since QNAP devices are quite popular, and whether there really is something fishy going on here.  I'll also ask QNAP support the same question to see if there's a legitimate purpose for accessing this IP.

Thanks!
Martin.


This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to mod2402
    Maybe, the server is now clean. URL query net don't find anything.
    urlquery.net - Free url scanner


    I honestly don't trust that site.  I have seen that in the past, yet the server continues to botnet and store .exe files that it even listed on that site, and it was the same problem children .exe files that were causing issues.

    OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
    (Former Sophos UTM Veteran, Former XG Rookie)

Children
No Data
Unfiltered HTML