So I was looking at some firewall logs and saw some strange activity on a remote IP address. I checked out the address via browser since https was open, the certificate was for *.twilio.com and twilio.com. It's an AWS address which is a popular choice for hackers who want to spin up a free server.
My first question is how could they get both the certificate and key for the twilio wildcard certificate?
My second question is what does this XML response mean? The page is masquerading as the twilio website. They owners of the firewall use twilio for phone and text purposes, could this XML response be used to do that? There were 2 recent attempts to execute this code.
<TwilioResponse> <Versions firstpageuri="/?Page=0&PageSize=50" numpages="1" end="1" total="2" previouspageuri="" lastpageuri="/?Page=0&PageSize=50" uri="/" pagesize="50" start="0" nextpageuri="" page="0"> <Version> <Name>2008-08-01</Name> <Uri>/2008-08-01</Uri> <SubresourceUris> <Accounts>/2008-08-01/Accounts</Accounts> </SubresourceUris></Version> <Version> <Name>2010-04-01</Name> <Uri>/2010-04-01</Uri> <SubresourceUris> <Accounts>/2010-04-01/Accounts</Accounts></SubresourceUris></Version></Versions> </TwilioResponse>