diff options
| -rw-r--r-- | 2025/2025-12-31-iab.md | 358 |
1 files changed, 358 insertions, 0 deletions
diff --git a/2025/2025-12-31-iab.md b/2025/2025-12-31-iab.md new file mode 100644 index 0000000..f7a2f53 --- /dev/null +++ b/2025/2025-12-31-iab.md @@ -0,0 +1,358 @@ +# October OAST Attack Traffic Analysis + +**Analysis Date:** 2025-12-31 +**Data Source:** `/Volumes/Extreme/oct-oasts.csv` +**Records:** 2,159 OAST callback domains + +--- + +## Executive Summary + +This dataset captures a **multi-actor vulnerability scanning campaign** spanning October 14-18, 2025. Unlike the single-source CTG dataset, this shows **126 distinct source IPs** across **22 OAST campaigns** from **21 unique scanner machines**. The traffic reveals both concentrated attacks from single IPs and distributed scanning from coordinated infrastructure (160.187.56.0/24 botnet-like cluster). + + + + +--- + +## Dataset Overview + +| Metric | Value | +|--------|-------| +| Total Records | 2,159 | +| Unique OAST Domains | 2,130 | +| Time Span | Oct 14-18, 2025 (~4 days) | +| Unique Source IPs | 126 | +| Unique Campaigns | 22 | +| Unique Machine IDs | 21 | +| Unique PIDs | 24 | + +--- + +## Top Threat Actors + +### 1. 194.163.180.145 (Contabo VPS) +- **Requests:** 968 (45% of traffic) +- **Campaigns:** `7onpk` (600), `nonpk` (328), `bh7on` (20), `terac` (15) +- **Machine ID:** `f8:be:69` +- **JA4T:** `64240_2-4-8-1-3_1460_7` (WSL Ubuntu pattern) +- **Duration:** Campaign `nonpk` ran 2.7 hours with counter range 2.8M-9.6M + +### 2. 160.187.56.0/24 Network (Distributed Cluster) +- **Requests:** 801 (37% of traffic) +- **IPs Active:** 25+ distinct hosts in the /24 +- **Campaign:** `6iseh` exclusively +- **Machine ID:** `d2:e3:a2` +- **JA4T:** `64240_2-4-8-1-3_1440_10` (MSS 1440, window scale 10) +- **Pattern:** Distributed scanning from coordinated infrastructure + +### 3. 45.61.187.53 (FranTech/BuyVM) +- **Requests:** 128 (6% of traffic) +- **Campaign:** `c647e` +- **Machine ID:** `86:21:dc` +- **JA4T:** `64240_2-1-3-1-1-4_1400_8` (different TCP options order) + +### 4. 104.248.99.110 (DigitalOcean) +- **Requests:** 87 (4% of traffic) +- **Campaign:** `emqgv` +- **Machine ID:** `d6:d4:3e` + +--- + +## Temporal Profile + +### Activity by Day + +| Date | Requests | +|------|----------| +| Oct 14 | 34 | +| Oct 15 | 713 | +| Oct 16 | 362 | +| Oct 17 | 1,028 | +| Oct 18 | 22 | + +### Peak Hours (UTC) +- 05:00-06:00: 433 requests +- 12:00-13:00: 374 requests +- 15:00-16:00: 428 requests + +--- + +## TCP Fingerprint Analysis (JA4T) + +| JA4T Fingerprint | Count | % | OS/Platform | +|------------------|-------|---|-------------| +| `64240_2-4-8-1-3_1460_7` | 1,089 | 50.4% | WSL Ubuntu 22.04 | +| `64240_2-4-8-1-3_1440_10` | 813 | 37.7% | Linux (MSS 1440, high window scale) | +| `65495_2-4-8-1-3_65495_7` | 162 | 7.5% | Linux (jumbo frames/loopback) | +| `64240_2-1-3-1-1-4_1400_8` | 61 | 2.8% | Linux (different TCP option order) | +| `65535_2-1-3-1-1-4_1460_8` | 17 | 0.8% | Linux variant | +| Others | 17 | 0.8% | Various | + +### Notable Patterns +- **MSS 1440** (37.7%): Indicates tunneled/VPN traffic or non-standard MTU +- **MSS 65495** (7.5%): Loopback/jumbo frame configuration +- **TCP options `2-1-3-1-1-4`**: Different option order than standard Linux + +--- + +## HTTP Fingerprint Analysis (JA4H) + +### Top JA4H Signatures + +| JA4H | Count | Description | +|------|-------|-------------| +| `po11nn060000_4ea4093e6290_*` | 821 | POST, 6 headers, no cookies/referer | +| `po11nn08en00_9cf61e78b7a7_*` | 378 | POST, 8 headers, Accept-Language: en | +| `po11nn050000_420df5be7212_*` | 149 | POST, 5 headers | +| `po11nn060000_da66f5d9ff4c_*` | 135 | POST, 6 headers, different header set | +| `po11nn070000_7662fdc2d666_*` | 115 | POST, 7 headers | + +### Method Distribution +- **POST:** 99% (2,144 requests) +- **PUT:** <1% (15 requests) +- **No cookies/referer:** 89% (scanner automation signature) + +--- + +## OAST Campaign Details + +### Major Campaigns + +| Campaign | Count | Machine ID | Duration | Source | +|----------|-------|------------|----------|--------| +| `6iseh` | 781 | `d2:e3:a2` | Instant | 160.187.56.0/24 | +| `7onpk` | 600 | `f8:be:69` | Instant | 194.163.180.145 | +| `nonpk` | 328 | `f8:be:69` | 2.7 hours | 194.163.180.145 | +| `c647e` | 128 | `86:21:dc` | Instant | 45.61.187.53 | +| `emqgv` | 84 | `d6:d4:3e` | Instant | 104.248.99.110 | +| `8b8vf` | 44 | `0b:47:df` | Instant | 194.99.22.136 | + +### Anomalous Timestamps + +~42 domains decode to 1978-1980 timestamps, indicating: +- Truncated/malformed subdomains in original payloads +- Intentionally corrupted preambles + +--- + +## OAST Domain Suffix Distribution + +| Suffix | Count | % | +|--------|-------|---| +| oast.live | 1,417 | 65.6% | +| oast.pro | 364 | 16.9% | +| oast.fun | 139 | 6.4% | +| oast.me | 133 | 6.2% | +| oast.site | 57 | 2.6% | +| interact.sh | 28 | 1.3% | +| oast.online | 21 | 1.0% | + +--- + +## Network IOCs + +### Source IPs (Top 15) + +``` +194.163.180.145 (968 requests) - Contabo +160.187.56.55 (188 requests) - Distributed cluster +45.61.187.53 (128 requests) - FranTech/BuyVM +160.187.56.125 (109 requests) - Distributed cluster +160.187.56.40 (95 requests) - Distributed cluster +160.187.56.10 (92 requests) - Distributed cluster +104.248.99.110 (87 requests) - DigitalOcean +194.99.22.136 (44 requests) +78.128.113.60 (28 requests) +194.165.16.71 (20 requests) +157.230.193.102 (19 requests) - DigitalOcean +222.85.220.6 (17 requests) - China Unicom +166.88.8.219 (14 requests) +185.219.79.12 (12 requests) +123.123.30.32 (10 requests) +``` + +### /24 Network Summary + +``` +194.163.180.0/24 - 968 requests (single host) +160.187.56.0/24 - 801 requests (25+ hosts - BOTNET CLUSTER) +45.61.187.0/24 - 128 requests +104.248.99.0/24 - 87 requests +``` + +### Machine IDs Observed + +``` +d2:e3:a2 (160.187.56.0/24 cluster) +f8:be:69 (194.163.180.145) +86:21:dc (45.61.187.53) +d6:d4:3e (104.248.99.110) +0b:47:df, 21:37:d8, 37:46:ab, 46:e7:a7, 71:3e:2f +71:75:b5, 73:a5:2e, 78:b9:66, 88:cc:a8, 8a:f6:88 +ab:be:2f, c1:58:75, ce:52:ee, e0:ce:ff, f9:0d:1f, fd:34:b8 +``` + +--- + +## R Analysis Code + +```r +library(dplyr) +library(readr) +library(lubridate) + +# Read the October OAST data +oct_data <- read_csv("/Volumes/Extreme/oct-oasts.csv", show_col_types = FALSE) + +# Basic overview +cat("=== Dataset Overview ===") +glimpse(oct_data) + +cat("=== Time Range ===") +cat("First:", format(min(oct_data$ts), "%Y-%m-%d %H:%M:%S")) +cat("Last:", format(max(oct_data$ts), "%Y-%m-%d %H:%M:%S")) +cat("Duration:", as.numeric(difftime(max(oct_data$ts), min(oct_data$ts), units = "days")), "days") + +# Source IP Distribution +oct_data %>% + count(src_ip, sort = TRUE) %>% + print(n = 25) + +# OAST Domain Suffixes +oct_data %>% + mutate(suffix = sub("^[^.]+\\.", "", oast)) %>% + count(suffix, sort = TRUE) + +# JA4T Fingerprints (TCP) +oct_data %>% + count(ja4t, sort = TRUE) + +# JA4H Fingerprints (HTTP) +oct_data %>% + count(ja4h, sort = TRUE) %>% + print(n = 20) + +# OAST Campaign Analysis +oct_data %>% + mutate( + preamble = substr(oast, 1, 20), + ksort = substr(oast, 1, 6), + campaign = substr(oast, 7, 11) + ) %>% + count(campaign, sort = TRUE) + +# Activity by Day +oct_data %>% + mutate(day = as.Date(ts)) %>% + count(day) + +# Hourly Distribution +oct_data %>% + mutate(hour = hour(ts)) %>% + count(hour) %>% + arrange(hour) + +# Top Source IPs by Campaign +oct_data %>% + mutate(campaign = substr(oast, 7, 11)) %>% + count(src_ip, campaign, sort = TRUE) %>% + filter(n >= 10) + +# Network /24 groupings +oct_data %>% + mutate(network = sub("\\.[0-9]+$", ".0/24", src_ip)) %>% + count(network, sort = TRUE) %>% + head(15) + +# JA4T by Source IP correlation +oct_data %>% + filter(src_ip %in% c("194.163.180.145", "160.187.56.55", "45.61.187.53")) %>% + count(src_ip, ja4t) %>% + tidyr::pivot_wider(names_from = ja4t, values_from = n, values_fill = 0) + +# JA4H Method Analysis +oct_data %>% + mutate( + method = substr(ja4h, 1, 2), + has_cookies = substr(ja4h, 5, 5), + has_referer = substr(ja4h, 6, 6) + ) %>% + count(method, has_cookies, has_referer, sort = TRUE) + +# Request Velocity +oct_data %>% + filter(src_ip == "194.163.180.145") %>% + mutate(minute = floor_date(ts, "minute")) %>% + count(minute) %>% + arrange(desc(n)) %>% + head(15) + +# Nonce pattern analysis +oct_data %>% + mutate( + nonce = substr(oast, 21, regexpr("\\.", oast) - 1), + has_yyyyy = grepl("yyyyy", nonce) + ) %>% + count(has_yyyyy) +``` + +--- + +## MCP Tools Used + +### OAST Domain Analysis + +``` +OAST Domains MCP Server:oast_campaign_analysis + path: /Volumes/Extreme/oct-oasts.csv + include_json: true +``` + +### JA4 Fingerprint Analysis + +``` +ja4-analysis:analyze_ja4t + fingerprint: 64240_2-4-8-1-3_1440_10 + Result: Linux, MSS 1440 (tunneled/VPN), window scale 10 + +ja4-analysis:analyze_ja4t + fingerprint: 65495_2-4-8-1-3_65495_7 + Result: Linux, jumbo frames/loopback configuration +``` + +--- + +## Key Findings + +1. **Multi-Actor Campaign:** Unlike the single-source CTG data, this shows 126 distinct IPs from at least 21 different scanner machines + +2. **Distributed Botnet Cluster:** The 160.187.56.0/24 network shows coordinated scanning from 25+ IPs, all using the same machine ID (`d2:e3:a2`) and campaign (`6iseh`) - indicates shared infrastructure or botnet + +3. **Dominant Actor:** 194.163.180.145 (Contabo) accounts for 45% of all traffic across multiple campaigns + +4. **TCP Fingerprint Diversity:** 8 distinct JA4T signatures suggest multiple scanning platforms/configurations + +5. **Modern Tooling:** All Interactsh instances are v1.0.2+ (no legacy 'yyyyy' nonces) + +6. **OAST Suffix Preference:** 65% used oast.live, suggesting infrastructure preference or testing + +--- + +## Comparison with CTG Dataset + +| Metric | CTG (Dec 29) | October | +|--------|--------------|----------| +| Records | 758 | 2,159 | +| Duration | 75 minutes | 4 days | +| Source IPs | 1 | 126 | +| Campaigns | 6 | 22 | +| Machine IDs | 5 | 21 | +| JA4T Fingerprints | 1 | 8 | +| OAST Suffixes | 4 | 7 | + +The October dataset represents a broader view of the OAST-enabled scanning landscape with multiple independent actors versus CTG's single focused campaign. + +--- + +*Analysis performed using R, OAST Domains MCP Server, and JA4 Analysis MCP Server* |