IPS detects blacknurse ICMP denial of service - false positive?

So, several firewalls I manage report from time to time a "SERVER-OTHER multiple products blacknurse ICMP denial of service attempt". Direction is outgoing, from my network to IP addresses of Google or Facebook.>!​!<

The source device was in many cases an iPhone, though I could not check all devices in each case.

I'm leaning towards a false positive as:

- Blacknurse is reported to be based on icmp_type 3

- The source device is an iphone (which are not impossible to infect, but are in my experience often safe)

Do you have any information to assure, if it's a false positive or not and if not, what would be your next steps?