In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall.
I have seen many outbound communications from internal IPs toward IP:
18.104.22.168 having host name:
match.basebanner.com which is having many blacklisted domains to which internal host are communicating.
Now I need to find out why these machines are communicating to these IPs. How to trace them and what proper remediation that I should recommend to my client to handle them?