Unusual traffic from 35.190.168.222

[Robert_Cerny]

Hi folks,

we are seing an unusual amount of inbound connection from 35.190.168.222 to our FG, specifically IP address bound to our mail server, port 443. This traffic seems to be harmless, but it's amount is really weird. It seems to be connected to googleusercontent.com, which is used for analytics and other google services. Does anyone know what's going on here?

Thanks

[rohitchoudhary1978]

Hi,

You may block this source ip address 35.190.168.222 or may ask email service provider [if outsourced] for the relation (It could be used to fetch some image).

To block, configure a policy with this source ip and destination to mail server ip, service = all, action to be deny.

If you get any issues then disable it.

Thanks

Rohit