Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 16 replies
  • Subscribers 3 subscribers
  • Views 10868 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM9 blocking Botnet traffic... but EP not finding anything...

DaveK67
I'm getting regular notifications that the firewall is blocking one of my systems from communicating with a known botnet site... but when I run an AV scan on that system it's coming up empty.  Any suggestions regarding 'step b'?  I'm trying other av and am products now to see if anyone else catches it - so far nothing is.  

UTM flags as 'C2/Generic-A' to destination 82.211.30.241 (IPTables).


This thread was automatically locked due to age.
Parents
  • 0
    Using that IP in your first post, I did a little basic threat intel research. Depending on which threat feeds Sophos uses, this could explain the "false positive". Several feeds have this IP listed as bad. 

    Attached is what  I found. I only used a few free tools, so more could be done. 

    The last image is in the next post.
Reply
  • 0
    Using that IP in your first post, I did a little basic threat intel research. Depending on which threat feeds Sophos uses, this could explain the "false positive". Several feeds have this IP listed as bad. 

    Attached is what  I found. I only used a few free tools, so more could be done. 

    The last image is in the next post.
Children
No Data
Unfiltered HTML