Why are hosts communicating with blacklisted IPs like match basebanner?

Question

In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall. I have seen many outbound communications from internal IPs toward IP: 74.217.31.51 having host name: match.basebanner.com which has many blacklisted domains to which internal hosts are communicating.

Reference:

https://www.virustotal.com/en/domain/match.basebanner.com/information/https://www.virustotal.com/en/ip-address/74.217.31.51/information/

Now I need to find out why these machines are communicating to these IPs. How to trace them and what proper remediation should I recommend to my client to handle them?

Ankur Dwivedi · Accepted Answer

Regarding the match basebanner, you should tell your client that they need to run virus scans on the source IPs and to inspect the browsers of those machines. They can also run netstat on the Windows machines: netstat -a -o -p TCP That will show them the process that initiated each TCP connection. Once they know what is triggering the connections, they can plan how to address the problem.

Why are hosts communicating with blacklisted IPs like match basebanner?

About this question

Your answer

1 Answer

More Cyber Security discussions

Learn & Explore

Cyber Security Tutorials

Cyber Security Interview Q&A

Latest Cyber Security Blogs

Want answers to more Cyber Security questions?

Stay in the loop — it’s free

You’re on the list!