Typosquatting in the wild!

One day, 

you are just auditing the firewall logs, just to see how the web filtering is working, and you find this:
 



What is this?  Am I being too strict with the firewall?
Go to Talos. What does it say about marvin-occentus.net?

Verdict: unfavorable.   False Positive?

Lets quickly google the domain:

What does the report say?  What does it do?  Tries to trick you into fake "Google updates"
Lets see what Shodan has to say?  Multiple vulnerabilities...
In the google search there was a marvin.occentus.net....   What does Talos have to say about that?
And for further verification, after an "nslookup" on marvin.occentus.net we take the IP to Shodan?
Loks respectable....


Who is Occentus? Looks like an IT company out of Spain.  Typosquatting in the wild.


















Comments

Post a Comment

Popular posts from this blog

Internal VPN

Image
 To tighten up home network, and to test,  I recently made a Wireguard server behind the Sophos firewall. My Sophos Firewall is built on an old PC and I have Proxmox on a little mini PC.  The ProxMox server is setup for various services like a Unifi Controller, FreePBX, Wazuh, and most recently a Wireguard server. Essentially, a client at work mentioned that they wanted "everyone to be on a VPN" and a friend was complaining about their VPN not working when they went to the office.  Everyone at the shop mocked the idea and said it would not work....   After building this setup with a Wireguard server and setting up some special rules on the firewall to allow VPN access across VLANS, I am convinced this is the best way to segment a network.  First you can VLAN everything separating various resources but then to limit access within those VLANS is easiest with the Internal VPN server.   
Read more

Its been a while...

 Too Much to talk about: Smart TVs are using the speaker as a microphone- they dont actually turn off when you hit the power button (who would have guessed any of that?  hahahha)....   did an Geolocation ban on my network... why are the "bad countries" always hitting my network?   data has been compromised so many times most people don't even care...   Froze my my credit with the 3 agencies a year or so back...  I would suggest you do it too
Read more

Physical Security/Automation

Image
 Fun little project. I had some of these RCWL-0516 boards laying around and a Raspberry Pi Pico so I started to wonder if I could make a motion sensor toy that would turn the lights on as i needed in my little workspace in the basement. Super easy cute python project: basically set it up to sense motion, and close a relay that turns on the LED light.    When you walk in the room the RCWL-0516 senses via microwave that there is motion, tells the Pico and the Pico sends a signal to the relay to close.   The relay will remained closed for 10 seconds after the motion is no longer detected. I am not sure how I am going to use this.... maybe a logging of detected motion and alerts?   IDK yet.
Read more