About faisal.mohammed-ext

faisal.mohammed-ext · 03-06-2017

Hello, I am getting 'MALWARE-CNC Win.Trojan.Glupteba C&C server READY command to client" alerts from Source port 10003 to high numbered destination ports in my network. Most of the source IP belongs a Linux server in my network. Where can I find th...

faisal.mohammed-ext · 02-24-2017

In the following DNS request traffic flow, instead of blocking the DNS request for a known Blacklisted domain (chickenKiller.com), can you explain why IronPort passed the DNS request to the Internal DNS server? Source: IronPort Internet Interface, D...

faisal.mohammed-ext · 02-24-2017

Great! Thank you Libin for explaining how ESA handles email messages containing the blacklisted domain. Kind Regards, Faisal M

faisal.mohammed-ext · 02-24-2017

Hi Libin, Can you take the example of the blacklisted domain "chickenkiller<.>com" to explain further. Would the ESA block messages with the balckisted domain "chickenkiller<.>com." http://www.senderbase.org/ lists "chickenkiller<.>com' as having poo...

faisal.mohammed-ext · 02-24-2017

Thanks for the quick response. I am new to IronPort. What does the "verified no" message entail? Thanks in advance. Faisal

Member Since	‎02-23-2017 12:02 PM
Date Last Visited	‎08-18-2017 03:56 AM
Posts	5

User Statistics

User Activity

MALWARE-CNC Win.Trojan.Glupteba C&C server READY command to client

How does CISCO IronPort email security handle Blacklisted domains - ex: chickenkiller.com

Great!

Hi Libin,

Thanks for the quick response