Silko Posted April 9, 2018 ID:1231243 Share Posted April 9, 2018 Hello, a few days ago the management console started to display the following message repeatedly: "Type: outgoing, Port: 52820, Process: dns.exe","09.04.2018 08:30:44","Blocked web site","167.114.154.30","Anti-Malware","XXXXX","XXXX.local","192.168.xx.xx","00-15-5D-xx-xx-xx","xxxxx","","","" The client is a domain controller and DNS server. Is that a false positive? What should we do now? Why is that IP blocked? i look Forward to Hearing from you. TIA Silko Link to post Share on other sites More sharing options...
djacobson Posted April 9, 2018 ID:1231415 Share Posted April 9, 2018 Hi @Silko, this block is legitimate. One of your workstations is attempting to resolve 167.114.154.30 through your DNS server. That IP is blocked due to NetWire malware using it to communicate. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now