0

I was looking into my websites traffic and found few entries from a subdomain for shnpoc.net domain. And when I looked into it, it was transparent proxying my website.
On checking further, I found this twitter post which states that the domain shnpoc.net is owned by Sky High Networks which is a subsidiary of McAfee.

These are a few more domains:
1. Suspicious shnpoc.net domains
2. Some more

My website URL is not in the list, but it has a similar sudomain, something of the sort of https://xxxx.yyyy.xxx.vignesh.shnpoc.net.

On checking SSL certificate some have Skyhigh Networks Inc. in owners name and some have McAfee LLC

What are these URLs? Are these phishing URLs?

I don't understand why SHN or McAfee needs to have these URLs?
Can anyone help me understand, what's all this? Whats happening?

Improve this question
2
  • We really do not have enough information to answer this. How is your site being hosted? With which provider is your site being hosted? What kind of custom JS files are running? Are you using any analytics tools? If so, which analytics tools? As you see, we have these questions & many more which we need answers to in order to give you a coherent answer - as such I've flagged this question as unclear.
    – user173641
    Commented Nov 18, 2019 at 8:39
  • @kadamb what requests are made to those URLs? Are those logs access logs?
    – Sir Muffington
    Commented Nov 18, 2019 at 22:37

1 Answer 1

Reset to default
1

Your company might have started doing a POC to acquire McAfee's CASB's product and as such is transparently redirecting some of your web traffic to their products. You might want to reach out to your administrator to get this clarified.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .