Bit of a weird one for me. I have a number of keywords included in Block Sites on my RBR850.
These seem to work fine, I get an alert every time they come up, which is good.
However, I've had a couple of occasions where a particular site is visited, that triggers an alert for a blocked site, but is showing up as from an IP address outside of my network.
This is puzzling. The timings of the first in particular was a bit odd too - being 01:34 in the morning.
I know the RBR50 that I just retired was prone to somewhat poorly coded log entries for attacks that didn't say that they had been blocked, but am curious if anyone else has come across something like this.
I'm concerned that the network has been compromised.
I've tried testing a block alert myself and it reports it as coming from my IP address, not an external one.
In fact, as I have been typing this, another such alert has come in and I'm the only one in the house right now..
[site blocked: www.website.com] from source nnn.nnn.nnn.nnn Thursday, Jun 02,2022 17:57:57
