It was reported in the ubiquity thread I linked. In looking into it further it seems to me that blizz might be initiating a connection remotely to ‘push’ certain data, triggered from your active connection. If I’m not mistaken, that is bad practice and not too shocking it matches a malicious signature – just like any RAT or reverse shell. I’m not too sure what Ubiquity or other vendors could do other than exclude the wow protocol. It also seems like blizz is aware of the problem, but is blaming firewalls generally ("transfer aborted: instance not found” in Shadowlands - #4 by Illìdàn-barthilas)