Advanced Threat Protection

It seems that the cause isn't from the firewall acting as a dns open relay. Further, these don't seem likely to be associated with hosts inside your networks making the requests, otherwise ATP would be triggering on the request, not on the reply. The ATP alerts do seem to be triggering on the data contained inside the DNS reply packets - specifically the "anmorencai.com" domain, and not the apparent origin or destination IPs, so requests shold contain a payload . So these apparently seem to be unsolicited DNS replies (hitting the external interface of your firewalls. 

Being UDP, who knows what the origin actually is, though. It may have been from China, as the IP suggests, but there's really no way to tell. This does just seem to be an excessive blast of activity directed a large number of machines across the internet.

I just logged into my SOPOS UTM Today and I too am receiving this warning from ATP...

Same here, at the first Time the was external addresses as source, after a while comes internal addresses too - but one of the address was a Windows Server, the other one was an OS X Client. I have no inbound DNS allowed, DNS relay only on internal interfaces. Configure Firewall that only DNS from my internal DNS Server can reach Google DNS Servers, no others. On my internal DNS Server create Zone for anmorencai.com and Geoblock China. After Reset the Counter yesterday, they give no warnings again.

I update the Virusprotection on every Server and scan it, nothings found. Google Search found nothings about this URLs, only Sophos Community informations.

Is it an false/positive?

Alan,

thank you for your post. I am sure in Sophos you have analyzed this behaviour. Could you share the analysis's output to community?

This will eliminate the needs to contact the Support.

Thanks.

All our clients are set up with internal only DNS allowed, if it was hitting my test firewall I'd love to packet capture and allow the attack to happen to see what it is but sadly our own firewalls were ignored with this :(

One of our clients had Support enter their machine and do a packet capture and have a record of the raw attack on the box as it was still happening but the contents were complete gibberish.

Maybe they weren't hit because the portscan from china was unsuccessful?

If a device doesn't block china, the portscan can poke and see that something is there so then they try hitting it again, hard.

(apologies for double post, I still mistake what bloody page I am on because it doesn't tell me unless I check and recheck all the time)

I too received these alerts.  I am new to this.  I have a host that is unable to connect to the web.  Curious if the UTM blocks outbound traffic of a host if a threat is detected?  If so, how do I unblock outbound traffic and get my host back up and running? 

I can successfully ping google dns: 8.8.8.8

But, browser will not connect?

Same thing here with one of my client, attack started at 03:24 and ended at 20:25 on Sunday.
One of the exam question on Sophos UTM Engineer exam was "Which type of traffic is scanned by the ATP module", right answer was "only outbound"...so this is confusing...:)

I did not do an in depth intel check, but this is what I do have:

Passive DNS (1)