IP and Domain Threat Intel Writeup

Overview

This room explores enriching IP and domain insights with open source threat intelligence tools, covering domain analysis, IP reconnaissance, and threat intelligence gathering.

Task 1: Domain Analysis

1.1 From the downloadable report, what are the IP addresses for the A Record associated with our flagged domain, advanced-ip-sccanner[.]com? Answer: IP-1, IP-2.

1.2 What nameserver addresses are associated with the IP address? Defang the addresses.

Task 2: IP Analysis

2.1 Open client.rdap.org and identify when the 64[.]31[.]63[.]194 IP was logged for registration. (Answer in UTC: MM/DD/YY, H:MM:SS AM/PM)

2.2 What roles are assigned to the entity Entity NOC2791-ARIN associated with the IP address 64[.]31[.]63[.]194?

2.3 What is the country's name for the IP 64[.]31[.]63[.]194?

2.4 Can you identify the Autonomous System linked with the IP 64[.]31[.]63[.]194?

Task 3: Open-source Intelligence Gathering

3.1 Using shodan.io, find which service is primarily associated with the IP address 85[.]188[.]1[.]133.

3.2 How many ports have been identified as open on the server?

3.3 Using search.censys.io, identify the TLS certificate fingerprint for the IP address.

3.4 According to crt.sh, are there Certificate Transparency log entries captured associated with the TLS certificate identified above? (Answer: Yay or Nay)

Task 4: Windows Artifact Analysis

4.1 What file has been linked to the IP 166[.]1.160[.]118?

4.2 What organisation is identified on historical WHOIS lookups?

Task 5: DNS and Domain Intelligence

5.1 What is the RIR associated with 170[.]130[.]202[.]134?

5.2 What ASN is the IP connected with?

5.3 Identify the number of NS records for the domain santagift[.]shop.

5.4 Which NS is identified as the Start of Authority (SOA) for the domain?

5.5 When was the domain registered? (Answer:DD/MM/YYYY)

Lessons Learned

• Open source threat intelligence tools provide valuable IP and domain insights
• RDAP protocol offers detailed registration information for IP addresses
• ARIN entities contain structured information about IP allocations and roles
• Autonomous System Numbers (ASNs) help identify network ownership
• Shodan.io reveals service information and open ports for IP addresses
• Censys provides TLS certificate information including fingerprints
• Certificate Transparency logs track SSL certificate issuance
• Malware samples can be linked to specific IP addresses
• Historical WHOIS data reveals past IP allocations and organizations
• RIRs (Regional Internet Registries) manage IP address allocation globally
• ASNs connect IP addresses to specific network providers
• NS records provide DNS infrastructure information
• SOA records indicate primary name servers for domains
• Domain registration dates help establish operational timelines