LAN to WAN Attack in Secureport

Options
GeoGuyOwo
GeoGuyOwo Posts: 1 image  Freshman Member
in Security
Secureport shows an "Attack" with the Source address being one of my internal workstations (192.168.nnn.nnn), and the destination a WAN address: 138.201.57.222.

I am not able to identify the purpose of the connection to 138.201.57.222
Nor can I identify why Zyxel considers the connection an "Attack".

How do I find out why is this considered an "Attack"?
What is 138.201.57.222?

All Replies

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,406 image  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fifth Anniversary
    edited August 2021
    Options
     
    Welcome to Zyxel community.
    You can refer to the below forum discussion link:
    The cause is that the session was initiated by the host (192.168.nnn.nnn) on your LAN side and
    accessed the data from the destination WAN IP(138.201.57.222), 
    then Zyxel UTM engine identified this behavior might be a malicious attack so blocked it.
    You can check it belongs to which attack type on the category item such as ADP, IDP, etc.
    You may provide the screenshot to us. Thanks.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）