The place where I work sometime is receiving some alert from the NIPS stating :
[1:30918:2] "MALWARE-CNC User-Agent known malicious user agent - User-Agent User-Agent Mozilla"
The user-agent in the paquet is :
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
It is coming from some clients accessing our website. It basically changes IP address. Either that or multiple client are infected. The rule indicate that the client would be infected with some virus trying to connect to an command and control server. It's a good thing that this paquet comes from outside, because the opposite would mean that we would be infected. What I don't understand is why is it trying to communicate with us? Obviously it's not a legit navigator like chrome or firefox, but rather a script trying to look like it. Shouldn't it try to communicate with the C&C server? Does this mean that our servers are infected (or were infected at some point) with some kind of C&C hop/proxy that redirect the information?