osmankandemir / associated-threat-analyzer

Associated-Threat-Analyzer detects malicious IPv4 addresses and domain names associated with your web application using local malicious domain and IPv4 lists.

👋 Hi

class README:
    def __init__(self):
        self.username = "Undefined"
        self.name = "Osman"
        self.surname = "Kandemir"
        self.age = "Undefined"
        self.contacts = {
            "Email": "osmankandemir00[@]gmail[.]com",
            "Whatsapp" : "Undefined",
            "Telegram": "Undefined",
            "GSM": "Undefined",
            "PGP" : "Undefined"
        }
        self.location = "localhost, Turkey"
        self.occupation = "Security Consultant, Backend Developer"
        self.operating_system = "Kali Linux, Windows, Debian, Ubuntu, Mint"

🖥️ Skills

• Information Security
• Cyber Security
• Backend Developer

Programming

Database

Frontend

🧪 QA & Testing

🎛️ Operating System

🗄️ DevOps & System

📜 Certificates

Name	Organization	Link
CCNA - Cisco Certified Network Associate	Cisco - Netacad	https://www.cisco.com
Certified Ethical Hacker V12	EC-Council	https://www.eccouncil.org/

associated-threat-analyzer's Issues

Unable to locate the sources of the malicious IP addresses

Hi @OsmanKandemir !

1. I've been examining one of my domains and the Docker-based analyzer detects a set of "Malicious Association" IPs
2. I went to examine deeper and check a couple of CNAME references of my domain and identified that domains of the CRM tools we used had overlapped with these "Malicious Association" IPs
3. I then removed the DNS records pointing to the CRM domains
4. After 3 days the tool still reports "FOUND -> Malicious Association"

I wonder, where those are coming from? After briefly looking at the code I did not understand how the list is determined. Would you mind helping me understand how to better use the tool to find the source of this association?

Thanks a lot for the analyzer and for the answer, in advance.