LAN to WAN Attack in Secureport

GeoGuyOwo

Secureport shows an "Attack" with the Source address being one of my internal workstations (192.168.nnn.nnn), and the destination a WAN address: 138.201.57.222.

I am not able to identify the purpose of the connection to 138.201.57.222

Nor can I identify why Zyxel considers the connection an "Attack".

How do I find out why is this considered an "Attack"?

What is 138.201.57.222?

Zyxel_Jeff

Hi @GeoGuyOwo

 

Welcome to Zyxel community.

You can refer to the below forum discussion link:

https://community.zyxel.com/en/discussion/11281/adp-detections-from-subnet-but-source-is-wan#latest

The cause is that the session was initiated by the host (192.168.nnn.nnn) on your LAN side and

accessed the data from the destination WAN IP(138.201.57.222), 

then Zyxel UTM engine identified this behavior might be a malicious attack so blocked it.

You can check it belongs to which attack type on the category item such as ADP, IDP, etc.
You may provide the screenshot to us. Thanks.