Something got past my router firewall?

[wahoowad]

Can you help me interpret what happened recently?

I run Symantec Endpoint Protection on my Windows7 PC (I get it free from work). A couple days after replacing my old router with this new RT-AC68U I have received two of the following alerts:

I believe this instance occurred right as I loaded a main Yahoo page (and that IP opens Yahoo's front page.) It looks to me like something either scanned my PC or an unsolicited attempt to connect to a port...? I thought my firewall would block something like this yet I appear to have it turned on:

Thoughts on what happened?

 

[thiggins]

Every time you load a web page, you download a LOT of files. Since you initiated the request, your router's firewall lets the traffic through.

That IP resolves to ce.8d.b6.static.xlhost.com. Could be an adserver that's on a Symantec blacklist.

At any rate, your router is not malfunctioning. That's why you need to run Antivirus / antimalware on every device.

 

[Puppa]

Yes, bad adservers on Yahoo seem quite common lately.

Sent from my SM-N920V using Tapatalk

 

[Puppa]

Turn on AI protection to help with bad adservers, but endpoint protection is probably updated more frequently.

Sent from my SM-N920V using Tapatalk

 

[wahoowad]

How does a 'bad adserver' manifest into a resource request that is blocked by my Symantec monitoring tool?

 

[thiggins]

How does a 'bad adserver' manifest into a resource request that is blocked by my Symantec monitoring tool?

See my previous answer. Either the server is on a blacklist or Symantec AV detected a bad file being downloaded.

 

[KenZ71]

I gave up on symantec years ago.

Got tired of the constant in your face updates, messages etc. Seemed like they were trying to justify themselves.