Who are the people in your neighborhood? Tracking 'Shady' CIDR blocks

on YouTube ↗43m

" summary

Shows a reproducible workflow that converts cloud CIDR lists into /24s, merges them with Zeek/bro conn.log and public feeds, and flags persistent external connections. Uses pandas and Jupyter notebooks plus Shodan and AlienVault data. Finds cobalt strike hosts clustering in a few /16s (119.5.x.x), notes 154 systems on port 10000 versus 6 fingerprinted C2s, matches 38 AWS /24s and ~480 DigitalOcean IPs to known bad web actors, and surfaces thousands of suspect connections.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 18:30Digital Slumlord
3. 26:16Aws
4. 38:33Know Who Your Neighbors Are

" related talks

• 59mCatching Malware En Masse: DNS and IP StyleDhia Mahjoub, Thibault Reuille, Andree Toonk · Black Hat USA 2014
• 39mCommSec D1 - Behaviors and Patterns of Rogue Hosting ProvidersD. Mahjoub, S. Brown · Hack In The Box Amsterdam 2018
• 50mTowards a Holistic Approach in Building Intelligence to Fight CrimewareDhia Mahjoub, Mykhailo Sakaly, Thomas Mathew · Black Hat USA 2016
• 43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey ScannersMasaki Kubo, Yukiko Endo, Masato Jingu · FIRST Conference 2026 (FIRSTCON26)
• 32mSomething’s Phishy: See the Hook Before the BaitMalachi Walker · BSidesSF 2025
• 41mInternet Spelunking: IPv6 Scanning and Device FingerprintingPiotr Kijewski, Dave De Coster · 34th Annual FIRST Conference 2022
• 26mInternet Scanning - Current State and Lessons LearnedMark Schloesser · Black Hat USA 2014
• 58mWhere did you find that?Niall Merrigan · NDC London 2017