# Potential False Positive for 2009099 being triggered by Aurora iOS app to AWS IP Addresses

**URL:** <https://community.emergingthreats.net/t/potential-false-positive-for-2009099-being-triggered-by-aurora-ios-app-to-aws-ip-addresses/3209>\
**Category:** Feedback & Support\
**Tags:** false-positives\
**Created:** [February 23, 2026, 7:14pm UTC](https://community.emergingthreats.net/t/potential-false-positive-for-2009099-being-triggered-by-aurora-ios-app-to-aws-ip-addresses/3209 "2026-02-23T19:14:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![keysox](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/keysox/32/1453_2.png) [@keysox](https://community.emergingthreats.net/u/keysox)\
**Post date:** [February 23, 2026, 7:14pm UTC](https://community.emergingthreats.net/t/potential-false-positive-for-2009099-being-triggered-by-aurora-ios-app-to-aws-ip-addresses/3209/1 "2026-02-23T19:14:24Z")

</div>

I am reporting a potential False Positive for **SID: 2009099** (ET P2P ThunderNetwork UDP Traffic). This rule is triggering from the [My Aurora Forecast & Alerts](https://apps.apple.com/us/app/my-aurora-forecast-alerts/id1073082439) iOS app. The traffic is directed to `qt-houston.bronze.systems` (72.41.9.x and 72.41.10x) on UDP port 10050. The data payloads are typically very small (~7 KB) and occur during app background refreshes.

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [February 23, 2026, 7:27pm UTC](https://community.emergingthreats.net/t/potential-false-positive-for-2009099-being-triggered-by-aurora-ios-app-to-aws-ip-addresses/3209/2 "2026-02-23T19:27:55Z")

</div>

Hi @keysox , we’ve disabled this rule while we take a look at it. Thanks for the report!