FLEX500: Application Patrol: HideMyAss, x-vpn and Psiphon false positives?

t80

Hello,
I'm experiencing a strange issue for the last 3-4 weeks as my FLEX500 is logging HideMyAss, x-vpn and Psiphon outgoing connections from many windows 10 and windows 11 lan computers.

These connections are vs specific public ips, ports 80 and 443, i.e. :

HideMyAss
52.21.115.110
34.111.175.102
34.160.176.28
44.220.123.14
35.186.243.246

x_vpn
20.101.38.191
51.89.9.254
178.250.1.12

Psiphon
51.89.9.252

I blocked outgoing connections to these ips and app patrol block no longer triggers.

I checked my PCs on LAN and none has HideMyAss, x_vpn, Psiphon or other vpn clients installed or running.

Is anyone experiencing the same issue?

Thank You,
t80

Zyxel_Tina

Hi @t80,

Welcome to the Zyxel Community!

To further investigate the issue, we would appreciate your assistance in capturing packet when the issue occurs for analysis.

Please capture packets from:

• The USG FLEX 500
• The affected Windows PC(s)

After collecting the files, please provide the following information via private message by clicking my profile > Message:

• The packet capture files
• The approximate timestamp when the detection occurred
• The source IP address of the affected client PC(s)

This information will help us verify the behavior. Thank you for your cooperation!

fedebros

Hi @t80 I noticed similar issues with x_vpn . If happens again I will collect more information.

electsystech

https://community.zyxel.com/en/discussion/33208/flex500-application-patrol-hidemyass-x-vpn-and-psiphon-false-positives

Yes. We've noticed incorrect blocks for HideMyAss and x_vpn as well. So far we've just been removing them from the app patrol policy.