INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Experimental Suspicious Domain Feed
Published: 2025-07-13
Last Updated: 2025-07-13 23:33:36 UTC
by Johannes Ullrich (Version: 1)
We have had a "newly registered domain" feed for a few years. This feed pulls data from ICANN's centralized zone data service (https://czds.icann.org) and TLS certificate transparency logs.
The ICANN CZDS is a good start, but it only offers data from top-level domains collaborating with ICANN. Missing are in particular country-level domains. Country-level zone files can be hard to come by, so we use TLS certificate transparency logs as a "cheap" alternative. Pretty much all domain registrars will, by default, create a "parked" website, and with that, they will make a certificate. Even if they do not, any halfway self-respecting phishing site will use TLS and register a certificate with a public certificate authority at one point. The TLS certificate transparency logs also help capture older domains.
Each day, we capture around 250,000 new domains using this system. But of course, we want to know which domains are used for malicious purposes. However, as the sample below shows, there are a lot of "odd" domain names ...
Read the full entry: https://isc.sans.edu/diary/Experimental+Suspicious+Domain+Feed/32102/
SSH Tunneling in Action: direct-tcp requests [Guest Diary]
Published: 2025-07-09
Last Updated: 2025-07-10 21:22:00 UTC
by Guy Bruneau (Version: 1)
[This is a Guest Diary by Sihui Neo, an ISC intern as part of the SANS.edu BACS program]
As part of the SANS degree program curriculum, I had the opportunity to set up a honeypot to monitor log activities mimicking a vulnerable server. I used the AWS free tier EC2 instance to set up the honeypot sensor in Japan and deployed Cowrie, a SSH and Telnet honeypot designed to log brute force attacks and shell interaction performed by an attacker.
In addition to the sensor setup, to allow me to easily look at all the logs in a single platform, I purchased a separate virtual private server and installed ELK SIEM, following the setup instructions from ISC mentor, Guy Bruneau’s github page. Then setup the sensor to send all logs to the SIEM server.
Since the setup of the honeypot, one of the interesting observations in logs was direct-tcp connection requests. More than 1000 different IPs within a month were seen to have made these requests and more than 75% were made to a single destination IP. In this post, I’ll cover how and why these connections are set up, and where the destination IP points to.
What did the logs look like? ...
Read the full entry: https://isc.sans.edu/diary/SSH+Tunneling+in+Action+directtcp+requests+Guest+Diary/32094/
More Free File Sharing Services Abuse
Published: 2025-07-16
Last Updated: 2025-07-16 13:00:28 UTC
by Xavier Mertens (Version: 1)
A few months ago, I wrote a diary about online services used to exfiltrate data. In this diary, I mentioned some well-known services. One of them was catbox[.]moe. Recently, I found a sample that was trying to download some payload from this website. I performed a quick research and collected more samples!
I collected (and stopped because it was a constant flood!) 612 URLs pointing to direct downloads (hxxps://files[.]catbox[.]moe/xxxxxx). Some were popular and used by multiple samples ...
Read the full entry: https://isc.sans.edu/diary/More+Free+File+Sharing+Services+Abuse/32112/