topic Re: FW access to domain &quot;accountsupportteam.com&quot; in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110460#M15170 <P>What kind of gateway running what version of code?<BR />My guess is that one of the clients is doing it.</P> Wed, 10 Feb 2021 15:22:16 GMT PhoneBoy 2021-02-10T15:22:16Z FW access to domain "accountsupportteam.com" https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110455#M15169 <P>Hi,</P><P>&nbsp;</P><P>Our CP Firewalls are constantly trying to reach out a domain named "accountsupportteam.com"</P><P>according to some sources in VirusTotal this domain is recognized as a malicious domain.</P><P>Does it familiar to someone? Why are they reach out to this domain?&nbsp;</P> Wed, 10 Feb 2021 14:42:57 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110455#M15169 Dvirg 2021-02-10T14:42:57Z Re: FW access to domain "accountsupportteam.com" https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110460#M15170 <P>What kind of gateway running what version of code?<BR />My guess is that one of the clients is doing it.</P> Wed, 10 Feb 2021 15:22:16 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110460#M15170 PhoneBoy 2021-02-10T15:22:16Z Re: FW access to domain "accountsupportteam.com" https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110461#M15171 <P>Reach out how? Are you able to share a redacted log card for the communication...</P> Wed, 10 Feb 2021 15:24:40 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110461#M15171 Chris_Atkinson 2021-02-10T15:24:40Z Re: FW access to domain "accountsupportteam.com" https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110751#M15231 <P>After an investigation and help from CP-Support, I found this object in "Object Explorer", and it turned out that the GWs are validating FQDN requests.<BR />Thank you all for your help.</P> Sun, 14 Feb 2021 08:36:32 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/FW-access-to-domain-quot-accountsupportteam-com-quot/m-p/110751#M15231 Dvirg 2021-02-14T08:36:32Z