ATP700 Reputation Filter false positive for BOTNETs

MBC_Andy
MBC_Andy Posts: 2
First Comment
in Security

Anyone else having issues with reputation filter false positives for BOTNETS on web sites? I have users going to seemingly harmless sites that are not blocked on my other routers but ATP700 is blocking for BOTNETs. My filter is set to medium and above and the log is showing the blocked sites as "High" risks.

All Replies

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,311  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Dear @MBC_Andy

    Welcome to the Zyxel community. Could you share the screenshot of the blocked Monitor Log message with us on the public discussion or send a private message to us? Besides, please tell us which URL and IP the host tried to browse and trigger this blocked action. Many thanks for your update for us in advance.

  • MBC_Andy
    MBC_Andy Posts: 2
    First Comment

    Hi Jeff,

    One of the URLs is https://pointofbreak.org and 2 associated IPs for them are 13.248.243.5 or 76.223.105.230.

    ATP700RepFilter.png
    ATP700LogScreen.png
    ATP700Screen2.png
    2023-06-13 09_25_09-Greenshot.png
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,311  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Dear @MBC_Andy

    Thanks for your feedback for us. We will correct it, please wait for our update. Thanks.

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,311  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Dear @MBC_Andy

    Could you update the signature of IP Reputation to our latest version(20230613)? We notice 13.248.243.5 and 76.223.105.230 are detected to the threat level to Neutral.

    IP-Reputation.png

    IP-Reputation_2.png

    Before you browse https://pointofbreak.org/ , we suggest you could clean your browser's cache and PC's local cache. Thanks.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）