An analyst came across this alert -
BlackHole Toolkit v2 JAVA Payload Stage Code Execution from the Checkpoint IPS coming from a server, the event is recorded as a blocked outgoing connection attempt - and to everyone's surprise has been triggering twice on average every hour for months(I know).
It was logged once a long time ago when first seen but the server owner said they didn't find anything on it.
The odd part is that the connection is only and always an outgoing attempt to one IP
126.96.36.199, which leads to a website called
This site means nothing to anyone and has no malicious activity attributed to it.
Can anyone please give us insight as to what it going on and how to address it?