Best way to alert Checkpoint of probable FPs?

[Fred_Joans]

Hello,

Checkpoint IPS has recently (09-08-2018) started erroneously tagging many domains ending in akamaiedge.net as malicious (Phishing_website.upvi) which is creating very large amounts of FP alerts. Here are some examples:

 e11696.dscg.akamaiedge.net

e16595.dsca.akamaiedge.net

e912.f.akamaiedge.net

e6640.g.akamaiedge.net

.. etc

Hopefully someone at Checkpoint reviews this post and fixes the issue ASAP. Thanks!

[PhoneBoy]

A TAC case is always your best bet in the case of a false positive.

I'll see what I can find out from our Threat Operations team, though.

[MK9]

I also encountered a similar problem (09-sept-2018 - 10-sept-2018).

[PhoneBoy]

The false positive should have already been addressed by now, assuming you have installed the latest IPS signatures.

[MK9]

Problem is solved:)