Author Archives: Xavier

[SANS ISC] Tracking Newly Registered Domains

Posted on by

I published the following diary on isc.sans.org: “Tracking Newly Registered Domains“: Here is the next step in my series of diaries related to domain names. After tracking suspicious domains with a dashboard and proactively searching for malicious domains, let’s focus on newly registered domains. They are a huge number of

[The post [SANS ISC] Tracking Newly Registered Domains has been first published on /dev/random]

Continue reading [SANS ISC] Tracking Newly Registered Domains→

Botconf 2017 Wrap-Up Day #3

Posted on by

And this is already the end of Botconf. Time for my last wrap-up. The day started a little bit later to allow some people to recover from the social event. It started at 09:40 with a talk presented by Anthony Kasza, from PaloAlto Networks: “Formatting for Justice: Crime Doesn’t Pay, Neither

[The post Botconf 2017 Wrap-Up Day #3 has been first published on /dev/random]

Continue reading Botconf 2017 Wrap-Up Day #3→

Botconf 2017 Wrap-Up Day #2

Posted on by

I’m just back from the social event that was organized at the aquarium Mare Nostrum. A very nice place full of threats as you can see in the picture above. Here is my wrap-up for the second day. The first batch of talks started with “KNIGHTCRAWLER,  Discovering Watering-holes for Fun,

[The post Botconf 2017 Wrap-Up Day #2 has been first published on /dev/random]

Continue reading Botconf 2017 Wrap-Up Day #2→

Botconf 2017 Wrap-Up Day #1

Posted on by

We reached December, it’s time for another edition of the Botconf security conference fully dedicate to fighting botnets. This is already the fifth edition that I’m attending. This year, the beautiful city of Montpellier in the south of France is hosting the conference. I arrived on Monday evening to attend

[The post Botconf 2017 Wrap-Up Day #1 has been first published on /dev/random]

Continue reading Botconf 2017 Wrap-Up Day #1→

[SANS ISC] Using Bad Material for the Good

Posted on by

I published the following diary on isc.sans.org: “Using Bad Material for the Good“: There is a huge amount of information shared online by attackers. Once again, pastebin.com is a nice place to start hunting. As this material is available for free, why not use it for the good? Attackers (with

[The post [SANS ISC] Using Bad Material for the Good has been first published on /dev/random]

Continue reading [SANS ISC] Using Bad Material for the Good→

[SANS ISC] Phishing Kit (Ab)Using Cloud Services

Posted on by

I published the following diary on isc.sans.org: “Phishing Kit (Ab)Using Cloud Services“: When you build a phishing kit, they are several critical points to address. You must generate a nice-looking page which will match as close as possible to the original one and you must work stealthily to not be blocked

[The post [SANS ISC] Phishing Kit (Ab)Using Cloud Services has been first published on /dev/random]

Continue reading [SANS ISC] Phishing Kit (Ab)Using Cloud Services→

[SANS ISC] Proactive Malicious Domain Search

Posted on by

I published the following diary on isc.sans.org: “Proactive Malicious Domain Search“: In a previous diary, I presented a dashboard that I’m using to keep track of the DNS traffic on my networks. Tracking malicious domains is useful but what if you could, in a certain way, “predict” the upcoming domains

[The post [SANS ISC] Proactive Malicious Domain Search has been first published on /dev/random]

Continue reading [SANS ISC] Proactive Malicious Domain Search→

[SANS ISC] Top-100 Malicious IP STIX Feed

Posted on by

I published the following diary on isc.sans.org: “Top-100 Malicious IP STIX Feed“. Yesterday, we were contacted by one of our readers who asked if we provide a STIX feed of our blocked list or top-100 suspicious IP addresses. STIX means “Structured Threat Information eXpression” and enables organizations to share indicator

[The post [SANS ISC] Top-100 Malicious IP STIX Feed has been first published on /dev/random]

Continue reading [SANS ISC] Top-100 Malicious IP STIX Feed→