Kerio Control may block legitimate traffic when Shield Matrix classifies a trusted external host (for example, <trusted_source_ip>) as a high-confidence threat (Confidence level 5), resulting in dropped connections.

Shield Matrix reputation is centrally calculated from global telemetry and is updated regularly (approximately every 15 minutes), so an IP can be reclassified even if it has been “trusted” in your environment for years. In newer Kerio Control builds (for example, 9.6.0 build 9161 and later), the preferred resolution is to add a Shield Matrix Whitelist/Exceptions entry for the trusted IP while keeping High confidence protection set to Log and drop for all other traffic.

Error / Symptom

Kerio Control blocks a trusted connection and shows Shield Matrix debug entries similar to:

{shieldmatrix} [ID] <id> connection classified as a threat. Confidence=5, Action=LOG_AND_DROP

Typically observed for traffic such as:

• Source IP:<trusted_source_ip>
• Destination IP:<destination_ip>
• Protocol: TCP

Why this happens

Shield Matrix uses centralized, global threat intelligence and heuristic detection. Reputation can change due to factors outside your environment (for example, short-lived abuse/compromise at a hosting provider, subnet/ASN correlation, or traffic patterns resembling automated attacks).

Key product behavior

• Shield Matrix decisions are not based on a locally editable “blacklist” in the traditional sense.
• Reputation is centrally computed from global telemetry and refreshed regularly (approximately every 15 minutes).
• In newer Kerio Control builds (e.g., 9.6.0 build 9161+), Shield Matrix includes a Whitelist/Exceptions mechanism so business-critical endpoints can bypass Shield Matrix blocking while the rest of the policy remains strict.