Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 13 replies
  • Answers 3 answers
  • Subscribers 13 subscribers
  • Views 23150 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ATP reporting source as external address

Stephen Allmark

Can someone suggest why the ATP would report an infection coming from an external address ?

 

Thanks

 



This thread was automatically locked due to age.
Parents
  • +1

    I'm getting the same symptoms from that same source on a UTM running firmware 9.406-3.  The aptp log shows it is protocol 6 (TCP) so this is probably unrelated to the previous UDP bug.  The source IP is in Saint Petersburg, Russia, which is not on my LAN.

    2016:10:26-10:33:01 xxxx afcd[31823]: id="2022" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet dropped (ATP)" srcip="195.62.53.168"
    dstip="xxx.xxx.xxx.xxx" fwrule="63001" proto="6" threatname="C2/Generic-A" status="1" host="lock.bz" url="" action="drop"


  • 0 in reply to tbenson

    A google search on that that "lock.bz" domain brings up pages that look like a risky click to me.  The search results are mostly cryllic and mention "vault".  Cryptolocker-related sites perhaps?

Reply Children
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Unfiltered HTML