{"id":27996,"date":"2022-12-12T18:17:33","date_gmt":"2022-12-12T17:17:33","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=27996"},"modified":"2022-12-12T18:17:33","modified_gmt":"2022-12-12T17:17:33","slug":"sophos-atp-reports-cloudflare-188-114-97-3-as-c2-generic-a-false-positive-dec-2022","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2022\/12\/12\/sophos-atp-reports-cloudflare-188-114-97-3-as-c2-generic-a-false-positive-dec-2022\/","title":{"rendered":"Sophos ATP reports Cloudflare 188.114.97.3 as C2\/Generic-A (false positive) – Dec. 2022"},"content":{"rendered":"

\"Sicherheit[German<\/a>]Quick survey or note to administrators who use Sophos security solutions (ATP). Currently it looks like the Sophos security products are misclassifying the Cloudflare IP address 188.114.97.3 as ATP C2\/Generic-A. After a blog reader informed me via a private Facebook message, some information on what I've found out so far.<\/p>\n

<\/p>\n

Sophos ATP and C2\/Generic<\/h2>\n

\"\"Sophos ATP (Advanced Threat Protection) is a feature of the Sophos XG Firewall<\/a>. Advanced Threat Protection<\/a> analyzes inbound and outbound network traffic for threats. With ATP, administrators can quickly detect compromised clients on your network and log or delete traffic from those devices..<\/p>\n

A C2\/Generic alert in Sophos ATP only says that malicious traffic has been observed. It could be a false positive detection, and a search on the Internet for ATP C2\/Generic reveals a number of hits in recent years.<\/p>\n

ATP classifies Cloudflare 188.114.97.3 as C2\/Generic-A ein<\/h2>\n

German blog reader Chris pointed me to this discussion<\/a> on the Sophos forum as of December 12, 2022. As of Sunday, a German user is asking the following regarding a DNS query that was found at fault (I've translated the post):<\/p>\n

ATP C2\/Generic-A Cloudflare 188.114.97.3 ?<\/p>\n

Good evening,<\/p>\n

Is there something to this why Sophos classifies the IP 188.114.97.3 as Malicious or again a FalsePositive?<\/p>\n

Our ATP of UTM9 reports this since Friday on DNS requests …<\/p>\n

..<\/p><\/blockquote>\n

Here is a screenshot from another source (private FB group on the subject).<\/p>\n

\"Sophos<\/p>\n

The problem is confirmed by other users. Someone posted the following log entries.<\/p>\n

2022:12:11-23:15:50 UTMFIREWALL named[6673]: rpz: client @0xb69a808 xxx.xxx.xxx.xxx#55357 (mastodon.lol): view default: rpz IP NXDOMAIN rewrite mastodon.lol via 32.3.97.114.188.rpz-ip.rpz\r\n2022:12:11-23:15:50 UTMFIREWALL named[6673]: rpz: client @0xb69a808 xxx.xxx.xxx.xxx#56326 (mastodon.lol): view default: rpz IP NXDOMAIN rewrite mastodon.lol via 32.3.97.114.188.rpz-ip.rpz\r\n2022:12:11-23:15:55 UTMFIREWALL named[6673]: rpz: client @0xb69a808 xxx.xxx.xxx.xxx#49629 (mindly.social): view default: rpz IP NXDOMAIN rewrite mindly.social via 32.3.97.114.188.rpz-ip.rpz\r\n2022:12:11-23:15:55 UTMFIREWALL named[6673]: rpz: client @0xb69a808 xxx.xxx.xxx.xxx#47000 (mindly.social): view default: rpz IP NXDOMAIN rewrite mindly.social via 32.3.97.114.188.rpz-ip.rpz\r\n2022:12:11-23:15:55 UTMFIREWALL named[6673]: rpz: client @0xb69a808 xxx.xxx.xxx.xxx#55935 (mindly.social): view default: rpz IP NXDOMAIN rewrite mindly.social via 32.3.97.114.188.rpz-ip.rpz\r\n2022:12:11-23:16:00 UTMFIREWALL named[6673]: rpz: client @0xaf8bc20 xxx.xxx.xxx.xxx#37920 (mindly.social): view default: rpz IP NXDOMAIN rewrite mindly.social via 32.3.97.114.188.rpz-ip.rpz\r\n2022:12:11-23:16:00 UTMFIREWALL named[6673]: rpz: client @0xaf8bc20 xxx.xxx.xxx.xxx#48306 (mindly.social): view default: rpz IP NXDOMAIN rewrite mindly.social via 32.3.97.114.188.rpz-ip.rpz<\/pre>\n
There are other voices in the thead reporting an Advanced Thread Protection alert from the firewall for additional addresses (e.g. Google DNS). Another user writes about this:<\/p>\n
I have the same fun,<\/p>\n
At Virustotal the IP is only classified as malicious by Sophos and Webroot, yesterday there were 3 providers, I strongly suspect FalsePositive. the underlying DNS queries now look quite unremarkable at my end.<\/p>\n
Is there actually a direct place at Sophos, where one can report such FalsePositives for the purpose of renewed examination?<\/p><\/blockquote>\n
Currently I assume that the ATP alerts are a false positive. Is anyone else from the readership affected by this effect? Is there any more detailed information about it?<\/p>\n
Addendum:<\/strong> On the forum, one affected person says \"The XGs are a bit more talkative, seems to be some Edge feature again. Maybe the automatically displayed messages? Microsoft itself will probably rather host nothing at Cloudflare…\" Since 2 hours the problem seems to be fixed.<\/p>\n","protected":false},"excerpt":{"rendered":"
[German]Quick survey or note to administrators who use Sophos security solutions (ATP). Currently it looks like the Sophos security products are misclassifying the Cloudflare IP address 188.114.97.3 as ATP C2\/Generic-A. After a blog reader informed me via a private Facebook … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1319],"tags":[],"class_list":["post-27996","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/27996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=27996"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/27996\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=27996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=27996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=27996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}