Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack. This attack analysis was focused to defend US midterm elections which will take place on November of 2018.

Here are the booby trapped web servers seized by Microsoft:

    name                            IP address      date updated 
    adfs-senate.email       17/08/2018
    adfs-senate.services    17/08/2018
    hudsonorg-my-sharepoint.com  14/08/2018
    my-iri.org              16/08/2018
    office365-onedrive.com  14/08/2018
    senate.group            17/08/2018

Of course is an IP adress belonging to Microsoft, and they will get all the traffic of machines trapped by this attack before August the 14th.

This attack, from Microsoft analysis, looks like it could be attributed to the criminal group APT28.

But some information is now missing for other countries who could be other targets of this attack campaign either directly or indirectly to later attack the United States through the usual connection laundering technic.

It would be interesting to detect the machines on which an attack was successfull everywhere in the world. For this analysis to be successful, the easiest way consists in entering within the Egress filtering rules of Internet firewalls rules of the form (at the top of Egress filtering group):

deny ip any <IP_address_of_booby_trapped_web_server> log

for the 6 servers identified by Microsoft.

And for this investigation we need the IP address attributed to these booby trapped web servers just before the seizure and update by Microsoft.

How may we quickly obtain what these criminals' IP addresses were before August the 14th within the international WHOIS database?

  • 1
    @TomK. there is a phrasing issue. The idea is to know who had those IPs before the 14th, not that those IPs should now be added to the database.
    – schroeder
    Aug 23, 2018 at 13:13
  • I took my own stab at changing the phrasing, if it helps.
    – schroeder
    Aug 23, 2018 at 20:04
  • Pretty clear...
    – dan
    Aug 23, 2018 at 20:18


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.