RT6600ax ET INFO Suspicious Domain (*.icu) in TLS SNI triggered by SynoForum

[johnnygoodface]

Hi guys
Whenever I open this forum, I get this Threat Prevention Alert: "ET INFO Suspicious Domain (*.icu) in TLS SNI"

Even though I trust this site (and I'll probably set this alert to Do Nothing), this raises a question:
Does Synology publish a site/document where it explains in details each rule that trigger the Alert/Drop Events that we see in TP?

I've read their TP documentation, but it's very basic. And nothing to be found on the web either.

 

[SynoMan]

Hi,

We run Matomo analytics over the .icu domain so it should be fine.

Does Synology publish a site/document where it explains in details each rule that trigger the Alert/Drop Events that we see in TP?

Not that I know.

 

[fredbert]

Does Synology publish a site/document where it explains in details each rule that trigger the Alert/Drop Events that we see in TP?

The rules don’t come from Synology, it uses Emerging Threats Open from ProofPoint.

Proofpoint Emerging Threats Rules