When visiting nfl.com/draft/2017 and clicking on the Tracker tab packets are being blocked and I receive alerts like the following.
Intrusion Prevention Alert
An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.
Details about the intrusion alert:
Message........: BROWSER-IE Microsoft Internet Explorer title integer overflow attempt
Details........: https://www.snort.org/search?query=40986
Time...........: 2017-05-01 10:20:41
Packet dropped.: yes
Priority.......: high
Classification.: Attempted User Privilege Gain
IP protocol....: 6 (TCP)
Source IP address: 23.219.92.130 (a23-219-92-130.deploy.static.akamaitechnologies.com)
Source port: 80 (http)
Destination IP address: XXX.XXX.XXX.XXX
Destination port: 3979
These appear to be false positives as akamaitechnologies.com is a content delivery service that multiple sites use and it is content coming from the official NFL website.
I am new to Sophos and firewalls but I thought I should be able to add an IPS exception.
I tried adding the following but that didn't seem to work.
I reached out to our vendor and they have not responded in over a week so I am reaching out to the community.
Any help would be wonderful.
This thread was automatically locked due to age.
