topic Re: geo-um.btrll.com Suspicious Activity in Firewall and Security Management

geo-um.btrll.com Suspicious Activity

Gaurav_Pandya — Fri, 09 Mar 2018 16:10:07 GMT

Hi,

We are getting Suspicious web browsing activity report from Threat prevention and the URL which hits almost all users are geo-um.btrll.com. However action is showing blocked and Category is Botnets.

Anyone has idea about this? What are the precautions need to take.

Re: geo-um.btrll.com Suspicious Activity

PhoneBoy — Fri, 21 Jun 2019 09:20:27 GMT

First of all this is a https://community.checkpoint.com/community/threat-prevention?sr=search&searchId=efab83ed-7362-4a86-bdda-37195c62c301&searchIndex=0‌ topic.

Second, it depends on the nature of the traffic.

What's it showing in the logs?

Re: geo-um.btrll.com Suspicious Activity

Sajid_Abbas — Tue, 13 Mar 2018 00:32:19 GMT

Hi,

We are having this same issue and getting a lot of matches under botnet category.

Is there an update that has been pushed or anything else

Sajid

Re: geo-um.btrll.com Suspicious Activity

Gaurav_Pandya — Tue, 13 Mar 2018 13:57:37 GMT

Hi,

I have gone through detailed user activity report and found that during this time mostly advertising URLs were opened which adds Popups / cookies and redirects to other URLs which is harmful.

This will not catch in Antivirus so need to remove those processes & Cookies to rectify the things.