For a couple of weeks i'm getting this message from the IPS module.
Message........: INDICATOR-COMPROMISE Suspicious .pw dns query
Details........: http://www.snort.org/search/sid/28039?r=1
Time...........: 2014-08-16 07:29:22
Packet dropped.: yes
Priority.......: high
Classification.: A Network Trojan was Detected
IP protocol....: 17 (UDP)
Source IP address: 192.168.*.30
Source port: 2599 (meridiandata)
Destination IP address: 192.168.*.1 (home)
Destination port: 53 (domain)
These notifications come in batches of 10 at a time.
Source IP (and thus device) is and Android phone and a Macbook Pro.
Source port is variable for each message.
Is this a false positive, or a real problem. Can't find anything on this matter on the web, even the snort.org URL gives me a 404 error.
Should I disable / ignore these notifications?
This thread was automatically locked due to age.
