Accessing a specific website triggering Spyware THREAT signatures

cancel
Showing results for 
Search instead for 
Did you mean: 

Accessing a specific website triggering Spyware THREAT signatures

L0 Member

Accessing following website is generating Spyware THREAT signatures. Does this means website is compromised and access should be blocked?

 

Website: 

www[.]51qiti.com

www.51qiti[.]com/faq/Faq1217.htm

 

Triggered signatures:

Suspicious PHP Command and Control Traffic Detection(85633)

Steganographic Webshell File Detection(85633)

 

1 REPLY 1

L1 Bithead

There are many resources in the internet that you may use to check these websites or urls. You can use Palo Alto's url checker/ site tester too,

https://urlfiltering.paloaltonetworks.com/

 

The ones that you have listed seem to have low risk but these have not yet been rated malicious. Location in China.

If not required for business you may check internally and have them blocked.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!