ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
ProxySG is sending DNS queries for malicious sites
Article ID: 169053
Updated On:
Products
ProxySG Software - SGOS
Issue/Introduction
These DNS queries are matching IPS attack signatures and being flagged as malicious traffic.
In most cases DNS queries are triggered by user request so check the proxy access log to verify.
In this specific case, it is triggered by the ProxySG.
In most cases DNS queries are triggered by user request so check the proxy access log to verify.
In this specific case, it is triggered by the ProxySG.
Cause
The customer has recently ran a script that sends "test-url" commands to the proxy to check content-filter category for each URL.
ProxySG#(config content-filter)test-url <URL>
This will trigger DNS queries for those URLs.
It also explains why those URLs are not found in the access log because "test-url" is an internal proxy function.
ProxySG#(config content-filter)test-url <URL>
This will trigger DNS queries for those URLs.
It also explains why those URLs are not found in the access log because "test-url" is an internal proxy function.
Feedback
Yes
No
Powered by
