Introduction Setting up a DShield honeypot is just the beginning. The real challenge lies in configuring all the necessary post-installation settings, which can be tedious when deploying multiple honeypots. Drawing from personal experience and valuable feedback from past interns at the Internet Storm Center (ISC), I developed DShieldKickStarter to automate
In the shadowy corners of the internet, a new vulnerability has emerged—one that doesn't attack through flashy ransomware or phishing emails but through the humble act of printing. Security researcher Simone Margaritelli (@evilsocket) has uncovered a series of critical flaws in the Common Unix Printing System (CUPS)
Executive Summary This report summarizes activity observed on the DShield sensor between September 12 and 15, 2024, targeting both web and SSH services. Multiple techniques, including SSH brute-force attacks and web-based automated reconnaissance attempts, were identified. The attackers primarily leveraged poorly configured services and default credentials across both attack surfaces.
As I’ve progressed through my internship with the Internet Storm Center, my interest in cyber threat intelligence has grown significantly, especially in the area of CVE reporting and impact assessment. This isn’t just theoretical; I’ve applied these concepts using tools like ELK and OpenCTI. Additionally, I’m
Executive Summary The following report provides an in-depth analysis of malicious activities conducted by IP 145.224.101.116, associated with SpaceX's Starlink ASNAME. This IP was specifically chosen for further investigation due to its association with the SpaceX ASN, which is an unusual and interesting origin for
