Threat Hunting Using These 3 Websites

Today, I'm going to show a simple way to do threat hunting using 3 websites: https://otx.alienvault.com, https://www.virustotal.com and https://www.abuseipdb.com. In order to replicate this yourself, you will need to create an account on otx.alienvault.com, but the others may be used with or without an account.

Now, this part of threat hunting in Cybersecurity, is a way to research IP addresses, email addresses, website URLs, file hashes, etc. to find out whether they are malicious or not. For example, if you receive an email that seems suspicious and you aren't sure that you should trust the information or links found in that email, you can use these websites to see if the email address or links in the email have been previously reported for malicious or suspicious activity.

So, let's get started!

Here, I used AlienVault to search for IP addresses that have come up on their system, and I randomly chose this one that is from Russia according to the overview.

When I copied that IP address into VirusTotal, the results indicated that 15 of 91 security vendors flagged it as malicious, and at the bottom of the screenshot we can see a few of those vendors.

I also copied the IP address into AbuseIPDB, which gave similar information, but also showed that this IP address has been reported 29,571 times and that the confidence of abuse according to this website is 100%, meaning they are very sure this IP address is malicious.

Let's look at another example:

Again, I used AlienVault to search for and then choose this IP address, whose verdict came up as "whitelisted", which raised my curiosity to find out more. Also, this one originated in the US.

When I searched it on VirusTotal, again 15 of 91 security vendors flagged it as a malicious IP address, but this time the report included a little summary explaining the types of threats executed through this IP address. Some examples include TCP port scanning, POP3 mailbox access attempts, and telnet brute-force login attempts.

AbuseIPDB also reported that their confidence of abuse from this IP address is 100%.

Now, let's look at an example using a website URL.

This time we see it is a website that originated in the UK.

The VirusTotal report shows that it is malicious, with 21 of 91 security vendors reporting it as such.

In summary, we can use these websites as resources to research different URLs, email addresses, IP addresses, etc. to see if they may be dangerous. These tools are very useful in the Cybersecurity space as they help professionals and regular internet users become aware of known sources of cyberattacks and threats, and to navigate their digital environments safely. Using the information found here, traffic from these malicious sources can then be blocked for digital security reasons.

Personally, it is also comforting to know that such a community exists in the Cybersecurity world, where information is shared about which sources one should be cautious of while navigating the digital space.