Traffic From fiddler2.com (50.56.19.116) to client

[Muiz]

Our firewalls are indicating that the host fiddler2.com (50.56.19.116) is sending traffic from its port 80 to our client which is being identified as potentially malicious malware. I am quite sure that this is a false-positive, but can anybody list the possible ways in which a client and a telerik server will communicate?

 

[Eric Lawrence]

Hi, Muiz--

Which "firewalls" are you using?

Can you elaborate on what "to our client" means? 

The Fiddler client application performs a version check on startup (e.g. by performing a HTTP GET to https://www.telerik.com/UpdateCheck.aspx?isBeta=True).

End-users may visit our website in their browser to download Fiddler.

Regards,
Eric Lawrence
Telerik

[Muiz]

Hi Eric,

These are enterprise-class Palo Alto Networks firewalls. The firewalls and the associated SIEM software indicated that there was data flow from 50.56.19.116 to the host running the Fiddler client which was tagged as generic command-and-control type data. I can't give you more information than that.

 

Muiz

[Eric Lawrence]

Hi,

Yup, it sounds like the firewalls are complaining about the version checks. You'll have to ask the vendor why the firewall has a false-positive here.

Regards,
Eric Lawrence
Telerik