[SID: 28265] Web Attack: Fake Codec Website 7 attack blocked. Traffic has been blocked for this application: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXE

Hi ,

Greetings .

Its been sometime that we are seeing these activities in our Network. Suspicious traffic still remains unrecognizable.

Attached is the threat Analysis logs from 2 of the affected machines. We found IP : 104.238.165.200 mentioned there.

We did notice in mejority of the afffected ma chine , this alert triggered when they connected to VPN although there were users who reported no such significance .

Looking for suggestions .

Symantec Case number - 08666260 .