I have a host on the Network that tries to send TCP/IP Packets to various servers. The DST Port is always 80 or 443 and the Flags set are RST and ACK. These Packets are blocked by our firewall. I did whois request for all target addresses and it where all addresses of the Google Cloud or Akamai. All 100 Request where sent within a secound. This happend several times.
My Suspicion now is that there are no further packets sent because the malware realized that the packets are blocked by the firewall. Is this a reasonable idea or is there a less malicious explaination for this behaviour?
// The questionable host is running windows 7.