C&C threat from outside 45.9.148.91 similar Shodan Malware hunter ?

[LeeFrancis2]

Hi Live community,

recently when investigating a false positive C&C threat blocked from "shodan malware hunter" I was pleased to see others had posted into this community about this. In the past 24 hrs we have 2 SIEM alerts for C&C outside to publically presented hosts from 45.9.148.91. Anyone else seeing this behaviour ?

PAN did reset both but I am considering a block rule, but of course the src IP could change at any time.

IP is on some blacklists:

xbl.spamhaus.org has blacklisted this IP.
zen.spamhaus.org has blacklisted this IP.

and appears to slowly, be carrying out reconnaissance on our public IP space.

KR,

Lee

[OtakarKlier]

Hello,

I try to keep things dynamic and self learning. Meaning I stay away from IP's since they change too fast. Since a EBL has it, i say let it run with it. Also I would enable sending telemetry back to Palo Alto so they can update their definitions so we dont have to :).

Hope that makes sense.