How do I report a false positive botnet?

07/01/2022 34 People found this article helpful 212,806 Views

Description

An alert was received from the SonicWall firewall with the message "Suspected Botnet responder blocked". Verifying manually, the public IP address which was blocked by the Botnet Filter is actually safe for my network. How can I work-around the blocking?

Resolution

Login to your firewall and navigate to Manage | Security Services | Botnet Filter
Click the highlighted text "Botnet IP Status Lookup".
You will be redirected to the page: IP Reputation Lookup
Choose Botnet, You can also report GEO IP location and Spam on the same page.
Click on To submit requests for status to be reviewed, please click here
Please fill in the details.

Add a temporary exclusion on the firewall:

Navigate to Network | Address Objects:
Create the appropriate Address Object. In our example we will add the Public IP address "62.149.128.15" and associate it with the WAN zone.
Network | Address Objects | Address Groups | Default Geo-IP and Botnet Exclusion Group | Edit:
Click on Edit of the Address Group "Default Geo-IP and Botnet Exclusion Group" and add the IP address you wish to bypass the Botnet Filter.
In our example we will add the Public IP address "62.149.128.15" to the Group and click on OK.
Navigate to Security Services | Botnet Filter:
Ensure that the Address Group in Exclusion is "Default Geo-IP and Botnet Exclusion Group".
The IP address will now be excluded from the Botnet Filtering, while the submission is being analyzed by SonicWall.