New answers tagged siem
Looks like someone is probably trying to brute force usernames/passwords or other malicious connections to your host. Either way you should never have telnet open because it is very insecure. You need to disable port 23 immediately on your host.
The IPS sensor seems to believe that 184.108.40.206 is a C&C server (this information is taken from McAfee itself, which analyzes the server to determine if it is malicious or not). A C&C would be a server that has been compromised and manages a botnet, for example. This is not a good sign. If this signature is showing up always for the same ...
Top 50 recent answers are included