path: root/2025/2025-12-31-iab.md

# October OAST Attack Traffic Analysis

**Analysis Date:** 2025-12-31
**Data Source:** `/Volumes/Extreme/oct-oasts.csv`
**Records:** 2,159 OAST callback domains

---

## Executive Summary

This dataset captures a **multi-actor vulnerability scanning campaign** spanning October 14-18, 2025. Unlike the single-source CTG dataset, this shows **126 distinct source IPs** across **22 OAST campaigns** from **21 unique scanner machines**. The traffic reveals both concentrated attacks from single IPs and distributed scanning from coordinated infrastructure (160.187.56.0/24 botnet-like cluster).

![d4412bac906133e81223c18ee7ab2328.png](:/1f30e7b5909a4ec990af931261b9efc5)

![df6d805e90ec0a73765e177a963afadc.png](:/bbdd4db0c1644259be93754ecefd6719)
---

## Dataset Overview

| Metric | Value |
|--------|-------|
| Total Records | 2,159 |
| Unique OAST Domains | 2,130 |
| Time Span | Oct 14-18, 2025 (~4 days) |
| Unique Source IPs | 126 |
| Unique Campaigns | 22 |
| Unique Machine IDs | 21 |
| Unique PIDs | 24 |

---

## Top Threat Actors

### 1. 194.163.180.145 (Contabo VPS)
- **Requests:** 968 (45% of traffic)
- **Campaigns:** `7onpk` (600), `nonpk` (328), `bh7on` (20), `terac` (15)
- **Machine ID:** `f8:be:69`
- **JA4T:** `64240_2-4-8-1-3_1460_7` (WSL Ubuntu pattern)
- **Duration:** Campaign `nonpk` ran 2.7 hours with counter range 2.8M-9.6M

### 2. 160.187.56.0/24 Network (Distributed Cluster)
- **Requests:** 801 (37% of traffic)
- **IPs Active:** 25+ distinct hosts in the /24
- **Campaign:** `6iseh` exclusively
- **Machine ID:** `d2:e3:a2`
- **JA4T:** `64240_2-4-8-1-3_1440_10` (MSS 1440, window scale 10)
- **Pattern:** Distributed scanning from coordinated infrastructure

### 3. 45.61.187.53 (FranTech/BuyVM)
- **Requests:** 128 (6% of traffic)
- **Campaign:** `c647e`
- **Machine ID:** `86:21:dc`
- **JA4T:** `64240_2-1-3-1-1-4_1400_8` (different TCP options order)

### 4. 104.248.99.110 (DigitalOcean)
- **Requests:** 87 (4% of traffic)
- **Campaign:** `emqgv`
- **Machine ID:** `d6:d4:3e`

---

## Temporal Profile

### Activity by Day

| Date | Requests |
|------|----------|
| Oct 14 | 34 |
| Oct 15 | 713 |
| Oct 16 | 362 |
| Oct 17 | 1,028 |
| Oct 18 | 22 |

### Peak Hours (UTC)
- 05:00-06:00: 433 requests
- 12:00-13:00: 374 requests  
- 15:00-16:00: 428 requests

---

## TCP Fingerprint Analysis (JA4T)

| JA4T Fingerprint | Count | % | OS/Platform |
|------------------|-------|---|-------------|
| `64240_2-4-8-1-3_1460_7` | 1,089 | 50.4% | WSL Ubuntu 22.04 |
| `64240_2-4-8-1-3_1440_10` | 813 | 37.7% | Linux (MSS 1440, high window scale) |
| `65495_2-4-8-1-3_65495_7` | 162 | 7.5% | Linux (jumbo frames/loopback) |
| `64240_2-1-3-1-1-4_1400_8` | 61 | 2.8% | Linux (different TCP option order) |
| `65535_2-1-3-1-1-4_1460_8` | 17 | 0.8% | Linux variant |
| Others | 17 | 0.8% | Various |

### Notable Patterns
- **MSS 1440** (37.7%): Indicates tunneled/VPN traffic or non-standard MTU
- **MSS 65495** (7.5%): Loopback/jumbo frame configuration
- **TCP options `2-1-3-1-1-4`**: Different option order than standard Linux

---

## HTTP Fingerprint Analysis (JA4H)

### Top JA4H Signatures

| JA4H | Count | Description |
|------|-------|-------------|
| `po11nn060000_4ea4093e6290_*` | 821 | POST, 6 headers, no cookies/referer |
| `po11nn08en00_9cf61e78b7a7_*` | 378 | POST, 8 headers, Accept-Language: en |
| `po11nn050000_420df5be7212_*` | 149 | POST, 5 headers |
| `po11nn060000_da66f5d9ff4c_*` | 135 | POST, 6 headers, different header set |
| `po11nn070000_7662fdc2d666_*` | 115 | POST, 7 headers |

### Method Distribution
- **POST:** 99% (2,144 requests)
- **PUT:** <1% (15 requests)
- **No cookies/referer:** 89% (scanner automation signature)

---

## OAST Campaign Details

### Major Campaigns

| Campaign | Count | Machine ID | Duration | Source |
|----------|-------|------------|----------|--------|
| `6iseh` | 781 | `d2:e3:a2` | Instant | 160.187.56.0/24 |
| `7onpk` | 600 | `f8:be:69` | Instant | 194.163.180.145 |
| `nonpk` | 328 | `f8:be:69` | 2.7 hours | 194.163.180.145 |
| `c647e` | 128 | `86:21:dc` | Instant | 45.61.187.53 |
| `emqgv` | 84 | `d6:d4:3e` | Instant | 104.248.99.110 |
| `8b8vf` | 44 | `0b:47:df` | Instant | 194.99.22.136 |

### Anomalous Timestamps

~42 domains decode to 1978-1980 timestamps, indicating:
- Truncated/malformed subdomains in original payloads
- Intentionally corrupted preambles

---

## OAST Domain Suffix Distribution

| Suffix | Count | % |
|--------|-------|---|
| oast.live | 1,417 | 65.6% |
| oast.pro | 364 | 16.9% |
| oast.fun | 139 | 6.4% |
| oast.me | 133 | 6.2% |
| oast.site | 57 | 2.6% |
| interact.sh | 28 | 1.3% |
| oast.online | 21 | 1.0% |

---

## Network IOCs

### Source IPs (Top 15)

```
194.163.180.145  (968 requests) - Contabo
160.187.56.55    (188 requests) - Distributed cluster
45.61.187.53     (128 requests) - FranTech/BuyVM
160.187.56.125   (109 requests) - Distributed cluster
160.187.56.40    (95 requests)  - Distributed cluster
160.187.56.10    (92 requests)  - Distributed cluster
104.248.99.110   (87 requests)  - DigitalOcean
194.99.22.136    (44 requests)  
78.128.113.60    (28 requests)
194.165.16.71    (20 requests)
157.230.193.102  (19 requests)  - DigitalOcean
222.85.220.6     (17 requests)  - China Unicom
166.88.8.219     (14 requests)
185.219.79.12    (12 requests)
123.123.30.32    (10 requests)
```

### /24 Network Summary

```
194.163.180.0/24  - 968 requests (single host)
160.187.56.0/24   - 801 requests (25+ hosts - BOTNET CLUSTER)
45.61.187.0/24    - 128 requests
104.248.99.0/24   - 87 requests
```

### Machine IDs Observed

```
d2:e3:a2  (160.187.56.0/24 cluster)
f8:be:69  (194.163.180.145)
86:21:dc  (45.61.187.53)
d6:d4:3e  (104.248.99.110)
0b:47:df, 21:37:d8, 37:46:ab, 46:e7:a7, 71:3e:2f
71:75:b5, 73:a5:2e, 78:b9:66, 88:cc:a8, 8a:f6:88
ab:be:2f, c1:58:75, ce:52:ee, e0:ce:ff, f9:0d:1f, fd:34:b8
```

---

## R Analysis Code

```r
library(dplyr)
library(readr)
library(lubridate)

# Read the October OAST data
oct_data <- read_csv("/Volumes/Extreme/oct-oasts.csv", show_col_types = FALSE)

# Basic overview
cat("=== Dataset Overview ===")
glimpse(oct_data)

cat("=== Time Range ===")
cat("First:", format(min(oct_data$ts), "%Y-%m-%d %H:%M:%S"))
cat("Last:", format(max(oct_data$ts), "%Y-%m-%d %H:%M:%S"))
cat("Duration:", as.numeric(difftime(max(oct_data$ts), min(oct_data$ts), units = "days")), "days")

# Source IP Distribution
oct_data %>%
  count(src_ip, sort = TRUE) %>%
  print(n = 25)

# OAST Domain Suffixes
oct_data %>%
  mutate(suffix = sub("^[^.]+\\.", "", oast)) %>%
  count(suffix, sort = TRUE)

# JA4T Fingerprints (TCP)
oct_data %>%
  count(ja4t, sort = TRUE)

# JA4H Fingerprints (HTTP)
oct_data %>%
  count(ja4h, sort = TRUE) %>%
  print(n = 20)

# OAST Campaign Analysis
oct_data %>%
  mutate(
    preamble = substr(oast, 1, 20),
    ksort = substr(oast, 1, 6),
    campaign = substr(oast, 7, 11)
  ) %>%
  count(campaign, sort = TRUE)

# Activity by Day
oct_data %>%
  mutate(day = as.Date(ts)) %>%
  count(day)

# Hourly Distribution
oct_data %>%
  mutate(hour = hour(ts)) %>%
  count(hour) %>%
  arrange(hour)

# Top Source IPs by Campaign
oct_data %>%
  mutate(campaign = substr(oast, 7, 11)) %>%
  count(src_ip, campaign, sort = TRUE) %>%
  filter(n >= 10)

# Network /24 groupings
oct_data %>%
  mutate(network = sub("\\.[0-9]+$", ".0/24", src_ip)) %>%
  count(network, sort = TRUE) %>%
  head(15)

# JA4T by Source IP correlation
oct_data %>%
  filter(src_ip %in% c("194.163.180.145", "160.187.56.55", "45.61.187.53")) %>%
  count(src_ip, ja4t) %>%
  tidyr::pivot_wider(names_from = ja4t, values_from = n, values_fill = 0)

# JA4H Method Analysis
oct_data %>%
  mutate(
    method = substr(ja4h, 1, 2),
    has_cookies = substr(ja4h, 5, 5),
    has_referer = substr(ja4h, 6, 6)
  ) %>%
  count(method, has_cookies, has_referer, sort = TRUE)

# Request Velocity
oct_data %>%
  filter(src_ip == "194.163.180.145") %>%
  mutate(minute = floor_date(ts, "minute")) %>%
  count(minute) %>%
  arrange(desc(n)) %>%
  head(15)

# Nonce pattern analysis
oct_data %>%
  mutate(
    nonce = substr(oast, 21, regexpr("\\.", oast) - 1),
    has_yyyyy = grepl("yyyyy", nonce)
  ) %>%
  count(has_yyyyy)
```

---

## MCP Tools Used

### OAST Domain Analysis

```
OAST Domains MCP Server:oast_campaign_analysis
  path: /Volumes/Extreme/oct-oasts.csv
  include_json: true
```

### JA4 Fingerprint Analysis

```
ja4-analysis:analyze_ja4t
  fingerprint: 64240_2-4-8-1-3_1440_10
  Result: Linux, MSS 1440 (tunneled/VPN), window scale 10

ja4-analysis:analyze_ja4t  
  fingerprint: 65495_2-4-8-1-3_65495_7
  Result: Linux, jumbo frames/loopback configuration
```

---

## Key Findings

1. **Multi-Actor Campaign:** Unlike the single-source CTG data, this shows 126 distinct IPs from at least 21 different scanner machines

2. **Distributed Botnet Cluster:** The 160.187.56.0/24 network shows coordinated scanning from 25+ IPs, all using the same machine ID (`d2:e3:a2`) and campaign (`6iseh`) - indicates shared infrastructure or botnet

3. **Dominant Actor:** 194.163.180.145 (Contabo) accounts for 45% of all traffic across multiple campaigns

4. **TCP Fingerprint Diversity:** 8 distinct JA4T signatures suggest multiple scanning platforms/configurations

5. **Modern Tooling:** All Interactsh instances are v1.0.2+ (no legacy 'yyyyy' nonces)

6. **OAST Suffix Preference:** 65% used oast.live, suggesting infrastructure preference or testing

---

## Comparison with CTG Dataset

| Metric | CTG (Dec 29) | October |
|--------|--------------|----------|
| Records | 758 | 2,159 |
| Duration | 75 minutes | 4 days |
| Source IPs | 1 | 126 |
| Campaigns | 6 | 22 |
| Machine IDs | 5 | 21 |
| JA4T Fingerprints | 1 | 8 |
| OAST Suffixes | 4 | 7 |

The October dataset represents a broader view of the OAST-enabled scanning landscape with multiple independent actors versus CTG's single focused campaign.

---

*Analysis performed using R, OAST Domains MCP Server, and JA4 Analysis MCP Server*