Security Geteway Sonicwall

Hi Yodaa,

The site at 23.40.219.11 is likely serving the malware. Reverse DNS shows that the IP belongs to Akamai Technologies, a very large CDN. It's entirely possible that someone is using the CDN to serve their malware.

It could also be a false positive.

You could run a packet capture on the 192.168.0.153 machine to gain more insight. A packet capture can also be run on the SonicWALL appliance.

I hope this helps.

But sonicwall  blocked it?

Also the ip 23.40.219.11 it trying to infect 192.168.0.153 ?

Yes, the SonicWALL blocked the threat.

I can't say for certain that 23.40.219.11 is actually trying to infect 193.168.0.153, but the log does seem to support that that's what's happening. You will to to investigate further to verify.

To investigate what would you propose ?

Also please could you explain this " It could also be a false positive" ?

this can be difficult "This is a somewhat involved process and will require a certain comfort level with network/packet analysis." No experience  with it.

Do you know any tutorial how to diagnosis packets in Wireshark?

thank you