08-13-2021 06:18 AM
Accessing following website is generating Spyware THREAT signatures. Does this means website is compromised and access should be blocked?
Website:
www.51qiti[.]com/faq/Faq1217.htm
Triggered signatures:
Suspicious PHP Command and Control Traffic Detection(85633)
Steganographic Webshell File Detection(85633)
08-15-2021 10:48 PM
There are many resources in the internet that you may use to check these websites or urls. You can use Palo Alto's url checker/ site tester too,
https://urlfiltering.paloaltonetworks.com/
The ones that you have listed seem to have low risk but these have not yet been rated malicious. Location in China.
If not required for business you may check internally and have them blocked.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
