3 ms·
Hmm, so then susam.in supposedly came out of a DGA in the wild being observed (or was a reverse engineered possibility) and then matched some level of checks to
by cobertos 3y ago
Hmm, so then susam.in supposedly came out of a DGA in the wild being observed (or was a reverse engineered possibility) and then matched some level of checks to try to weed out false positives.
Still feels sloppy that their whatever they're hosting looked enough like a C2 server/reverse proxy point to a C2 server to get their domain _seized_. That's quite a drastic action, especially across countries being it's a .in domain.
- m3047 3y ago99% correct in my estimation. Sloppy... that's where I'm not sure; heavy-handed? Certainly. I said I wasn't covered by noncompetes any longer, I didn't say I felt comfortable spilling all on HN. I'm also not current on what covenants are in place around .in specifically. If I was investigating this I would start with the hosting for susam.in and could it have been compromised.
- m3047 3y agoIf threat intelligence intrigues you, you're welcome to stalk me and send me a connection request on LinkedIn. And as a footnote to the "how the fuck..." comment, maybe it should be FCANN rather than ICANN for truth in advertising.