How can i find hosts connected to Monero crypto site

[Rabarbar1]

Hi.

Fortigate reports in its weekly reports that the monero.cryptocurrency.miner application has had a certain number of sessions open in the past (e.g. 1,790 sessions this week). I would like to trace where this traffic is coming from. How can I do this? In section "Log&report" a cannot find anything.

[abarushka]

Hello,

You may consider to navigate GUI: "Log&Report" -> "Forward Traffic" and use "Application" as filter.

[hbac]

Hi @Rabarbar1,

You can check the Forward traffic logs during the same date and time to find the source IP of those connections. 

Regards,