Solarwinds Application server connecting to malicious IP

Question

Hi,

The networking reporting tool in our organization is reporting that our solarwinds application server is sending traffic to the IP "93.184.220.29", which is blocked by our network edge firewall. The reputation of the this IP on virus total shows malicious. I need you suggestion to troubleshoot this case.

Regards,

sohail

jreves · Answer

Confirm that here: SSL/TLS OCSP and CRL in DigiCert new Web PKI hierarchy certificates

sohrashid · Answer

@jferandezThis IP is hosting CRL and OCSP services for Digicert CA and hosts need to connect to it to validate certificates. The reputation check is false positive.

marcrobinson · Answer

Can you post any updates on this?