ATP dropping several C2/Generic threats for two of my devices

Question

I haven&rsquo;t changed any settings on my Sophia XG but today I started receiving multiple threat alerts from ATP for the following: 
 2020-11-22 20:26:14Advanced threat protectionmessageid="18010" log_type="ATP" log_component="Firewall" log_subtype="Drop" user="" protocol="TCP" src_port="49348" dst_port="80" src_ip="172.16.16.47" dst_ip="31.171.154.67" url="31.171.154.67" threat="C2/Generic-A" event_id="7825B787-F721-400B-BEBD-40BEA61EFDC9" type="Standard" host_login_user="" host_process_user="" endpoint_id="" execution_path="" 
 It&rsquo;s occurring for two devices on my network, my Apple iPad and Dell XPS laptop (Ubuntu). Tried looking up the destination IP but nothing comes up. I&rsquo;ll get about 20-30 alerts in rapid succession then it stops. I wasn&rsquo;t doing anything particular on either my Dell XPS or iPad. 
 Anyone have any idea what might be causing this?

shred · Accepted Answer

After doing some more research, it looks like this is the Private Internet Access (PIA) VPN app that's pinging this IP address. You can read about it here on this reddit thread. It appears Malwarebytes was also incorrectly classifying this IP address as malicious but they have since fixed it. Hopefully Sophos provides an update as well.

---

Sophos XG guides for home users: https://shred086.wordpress.com/

Vishal_R · Answer

Hi shred : The destination IP is classified as in Malware/Malicious and due to that ATP is triggering alert and drop on same. https://www.virustotal.com/gui/url/bebbcfb5ef3c3ecfdc69fc11aa69c5066e76a5071a5f991f9b4ebf3d3f6a03af/detection On your Ubuntu Laptop, you may start TCPDUMP on this destination and once any packets getting observed you may dig further with netstat command or other Linux system relevant command to see or to confirm which app on system or socket or browser plugin or any script or anything knowingly or unknowingly is generating traffic on this destination server.

ATP dropping several C2/Generic threats for two of my devices

Top Replies