0

I was looking into my websites traffic and found few entries from a subdomain for shnpoc.net domain. And when I looked into it, it was transparent proxying my website.
On checking further, I found this twitter post which states that the domain shnpoc.net is owned by Sky High Networks which is a subsidiary of McAfee.

These are a few more domains:
1. Suspicious shnpoc.net domains
2. Some more

My website URL is not in the list, but it has a similar sudomain, something of the sort of https://xxxx.yyyy.xxx.vignesh.shnpoc.net.

On checking SSL certificate some have Skyhigh Networks Inc. in owners name and some have McAfee LLC

What are these URLs? Are these phishing URLs?

I don't understand why SHN or McAfee needs to have these URLs?
Can anyone help me understand, what's all this? Whats happening?

  • We really do not have enough information to answer this. How is your site being hosted? With which provider is your site being hosted? What kind of custom JS files are running? Are you using any analytics tools? If so, which analytics tools? As you see, we have these questions & many more which we need answers to in order to give you a coherent answer - as such I've flagged this question as unclear. – J.J Nov 18 '19 at 8:39
  • @kadamb what requests are made to those URLs? Are those logs access logs? – Sir Muffington Nov 18 '19 at 22:37
1

Your company might have started doing a POC to acquire McAfee's CASB's product and as such is transparently redirecting some of your web traffic to their products. You might want to reach out to your administrator to get this clarified.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.