topic Network Traffic Categorized as Malware in General Topics

Network Traffic Categorized as Malware

Anthony_Gomez — Fri, 31 Mar 2023 18:59:47 GMT

We are seeing an uptick in normal network traffic being classified as malware. Example sites include nasdaq, vice, and times. One thing they have in common is that the dest IPs points back to leaseweb. Is anyone else seeing this or know of a change that could be causing this?

Re: Network Traffic Categorized as Malware

kiwi — Tue, 04 Apr 2023 11:14:29 GMT

Hi @Anthony_Gomez ,

Maybe a recent content update triggered something. I'd suggest grabbing some of the PCAPs from the threat log and file them with support for analysis.

Kind regards,

-Kiwi.