Issue
- You have been affected by the network protection alert
- EsetIpBlacklist
- Botnet.CnC.Generic
Solution
These alerts occur when a user has open ports on a hardware firewall and a malicious IP address is trying to engage in hacking attempts or other malicious behavior.
Check a global blacklist to verify if the Public IP address is blacklisted.
When a user is affected by multiple alerts from different source IP addresses, it can also mean the attacker is running a vulnerability scan on their public IP address.
EsetIpBlacklist alert
The source IP address is the public IP address and the target is the machine with the open port.
We recommend that users do not have any open ports to the internet.
Botnet.Cnc.Generic alert
ESET detects the source IP address and notifies the user which ports are open on the hardware firewall.
We recommend that users do not have any open ports unless it is necessary and that all malicious public IP addresses that ESET detects on their hardware firewall are blocked.
