I noticed yesterday that our firewall had reported this anomaly coming from our mail server. The destination IP is simply an open DNS I added to the DNS setting on the device but this also occurs on the other entries as well, why would it report this?
Hi Newby,
i was able to reproduce this error
The content of your DNS Query "sync.header.direct" seems to be known as malicious.
if your Mailserver is not infected it maybe got an email (send or received doesn't matter) and needs to lookup some DNS stuf to verify (mx record / spf record) either to send or to do antispam.
please check if your Mailserver has a queued mail to or from that domain. (maybe in logs for that tiestamp)
Yours Lukas
