---
# System prepended metadata

title: 'CCF Lab 1: Data Acquisition'

---

 ssuccess
# Security Analysis Report: Kaspersky Lab Domain and Subdomains
**Name: Ahmad Mohamad Quasem Almoumani**
:::

<!-- This is a comment which gets skiped from rendering -->

---
# Task 1:
:::info
**Domain names (including subdomains)**
:::

**Tool Used** I used sublist3r, Amass, Subfinder and Knockpy to find Domain and Subdomains


I found 790 subdomains using **sublist3r**


![](https://hackmd.io/_uploads/BJeZJywMp.png)

I found 7366 subdomains using **Subfinder**




![](https://hackmd.io/_uploads/HkQDmpUM6.png)

I found 1591 subdomains using **Knockpy**



![](https://hackmd.io/_uploads/r1Psma8Mp.png)

I found many subdomains using **Amass**

![](https://hackmd.io/_uploads/ryvuAZKGa.png)


I filterd 1591 for **Validation** to check if there are inactive or died domain/subdomain using this script 
```

subdomains_file="subfinder_output.txt"


active_subdomains_file="active_subdomains.txt"


while read -r subdomain; do
    
    ping -c 1 "$subdomain" > /dev/null 2>&1

   
    if [ $? -eq 0 ]; then
        echo "$subdomain is active"
        
        echo "$subdomain" >> "$active_subdomains_file"
    else
        echo "$subdomain is inactive or does not resolve"
    fi
done < "$subdomains_file"


```




![](https://hackmd.io/_uploads/ryY0kSKGp.png)

**I got 1088 domain/subdomain actives**

you can find the list of the filtered domains on this link

[https://drive.google.com/file/d/1GYaD-zUIOGEDtxLitT_yJdQY-MxmF6FD/view?usp=sharing]






---
:::info
**· Network Ranges**
:::



**Network Range (CIDR Notation): 185.85.15.0/24**


This range includes:

**Network Address**: 185.85.15.0
**Usable Host IP Range**: 185.85.15.1 to 185.85.15.254
**Broadcast Address**: 185.85.15.255
**Total Number of Hosts**: 256
**Number of Usable Hosts**: 254
**Subnet Mask**: 255.255.255.0
**IP Class**: C


---
:::info
**IP Addresses**
:::




**Tool Used**: theHarvester & dig command

**Working Principle**:
**theHarvester**: Utilizes passive data sources and databases to fetch IP addresses associated with the target.
**dig**: Resolves domain names to IP addresses.

I use the **dig** command to get IP addresses: from the list of the Domains
by 
for ipv4
```
while read -r subdomain; do
    ip=$(dig +short "$subdomain" A)
    if [ ! -z "$ip" ]; then
        echo "$subdomain has IP address $ip"
        echo "$ip" >> "ips_output.txt"
    else
        echo "$subdomain does not have an IPv4 address"
    fi
done < "$active_subdomains_file"

```

then i removed duplicate IP addresses using

`sort ips_output.txt | uniq > unique_ips.txt`

**I got 257 IPs** 

the IPs can be found on this link 
[https://drive.google.com/file/d/1XHEgLprNVyYfwNk0qn7__odOi8_rKfOB/view?usp=sharing]

**i did not find  IPv6**


---

also i found 224 IPs using **`theHarvester -d kaspersky.com -l 300 -b all`**


![](https://hackmd.io/_uploads/S1YXQdqfp.png)

the IPs can be found on this link

[https://drive.google.com/file/d/1e63qaDH6-hZ2Tte102w3L6GMiA0zLQBW/view?usp=sharing]

I compared between the two lists I found only 4 common IPs

```119.254.74.53
212.5.110.156
212.5.110.163
216.239.32.21
```
  

---

:::info
**Email addresses of employees**
:::
  
  I used **hunter.io** i found 430 email
  
![](https://hackmd.io/_uploads/BJ2BJF9Ga.png)

```
elizaveta.kaydash@kaspersky.com
sales-kasperskyos@kaspersky.com
sea.sales@kaspersky.com
nikolay.grebennikov@kaspersky.com
elena.feofilaktova@kaspersky.com
triangulation@kaspersky.com
eugene.kaspersky@kaspersky.com
vyacheslav.zakorzhevsky@kaspersky.com
olga.rodicheva@kaspersky.com

```



---


**Potential Threats and Frauds:**

Phishing Campaigns: Attackers can use gathered email addresses for targeted spear-phishing.
Domain Squatting: Miscreants might register domains similar to Kaspersky's genuine domains to deceive users.
Impersonation: Using gathered data, attackers might impersonate Kaspersky representatives in communications.


# Task 2:
:::info
**During the information gathering, 10 domains where detected to have web pages which are listed below;**
:::
```


https://www.kaspersky.com/?domain=transperancy.kaspersky.com
https://www.kaspersky.com/?domain=devsharepoint.kaspersky.com
https://www.kaspersky.com/?domain=newsvirus.kaspersky.com
https://www.kaspersky.com/?domain=cadeto.kaspersky.com
https://www.kaspersky.com/?domain=comvirusdesk-org.kaspersky.com
https://www.kaspersky.com/?domain=gatherer.kaspersky.com
https://www.kaspersky.com/?domain=wllab-t.kaspersky.com
https://www.kaspersky.com/?domain=ctsync.antitheft.kaspersky.com
https://www.kaspersky.com/?domain=spmigrate.kaspersky.com
https://www.kaspersky.com/?domain=autoactivation3.kaspersky.com

```
:::info
**During the information gathering, 20 domains where detected to have web pages which are listed below;**
:::

```
https://www.kaspersky.com/?domain=aws.kaspersky.com
https://www.kaspersky.com/?domain=b.kaspersky.com
https://www.kaspersky.com/?domain=autoactivation6.kaspersky.com
xtraining.kaspersky.comxtraining.kaspersky.com
https://www.kaspersky.com/?domain=wlsaas-api.kaspersky.com
https://www.kaspersky.com/?domain=whitelististing.kaspersky.com
whitelist.kaspersky.com 
windows.kaspersky.com 
https://www.kaspersky.com/?domain=wallet.kaspersky.com
https://www.kaspersky.com/?domain=vpnpa.kaspersky.com
https://www.kaspersky.com/?domain=virusdesk.2010.kaspersky.com
https://www.kaspersky.com/?domain=virusdesk-oceania.kaspersky.com
https://www.kaspersky.com/?domain=virusdesk-16.kaspersky.com
https://www.kaspersky.com/?domain=verification.content.ipm2.kaspersky.com
https://www.kaspersky.com/?domain=virusdesk.13.kaspersky.com
https://www.kaspersky.com/?domain=virusdesk.2.kaspersky.com
https://usa.kaspersky.com/blog/
https://www.kaspersky.com/?domain=uisidt.kaspersky.com
https://www.kaspersky.com/?domain=trusted.kaspersky.com
https://tprovider.kaspersky.com/pod/Login.aspx?ReturnUrl=%2fpod%2fdefault.aspx

```
:::info
**During the information gathering, 30 domains resolve to IP addresses, but no web pages were found on them which are listed below;**
:::
```
http://awarenesssummit.kaspersky.com/
b-kaspersky.comvirusdesk.kaspersky.com:185.85.15.26 
http://autodiscover.kaspersky.com/
autocomplete.kaspersky.com 
https://west-us.dynamic.content.ipm.kaspersky.com/
http://vpn.kaspersky.com/
http://wlinfo.kaspersky.com/
http://ussbc1.kaspersky.com/
ussbc1.kaspersky.com:12.9.89.2
ussbc1.kaspersky.com
http://test.ktsbeta.kaspersky.com/
http://test.kts.kaspersky.com/
http://test.ktsbeta.kaspersky.com/
http://terms.demo.korm.kaspersky.com/
http://terms1.demo.korm.kaspersky.com/
https://tasupport.kaspersky.com/
http://taxii-1.tip.kaspersky.com/
http://syncnordnet.ktsbeta.kaspersky.com/
http://synctim.ktsbeta.kaspersky.com/
taxii.tip.kaspersky.com
http://taxii.ha.kaspersky.com/
http://svpnfg.kaspersky.com/
https://trash.kaspersky.com/
http://sts.kaspersky.com/
http://socialization.ha.kaspersky.com/
http://south-asia.adci.ipm.kaspersky.com/
http://south-asia.dynamic.content.ipm.kaspersky.com/
http://south-asia.ipmcloud.kaspersky.com/
https://shop.africa.kaspersky.com/
https://shop.baltics.kaspersky.com/
```
:::info
**During the information gathering, 40 domains do not resolve to an IP address which are listed below:**
:::


```
http://west-us.adci.ipm.kaspersky.com/
ussbc1.kaspersky.com
http://uisstg.geo.kaspersky.com/
http://taxii-3.tip.kaspersky.com/
http://sip.kaspersky.com/
http://synctim.ktsbeta.kaspersky.com/
https://stash.kaspersky.com/
```



:::info
**Prepare short notification to the Customer that should include description of risks related to the findings, and provide recommendations that will allow to reduce the risks.**
:::


```
Notification: Protecting Your Information from Online Risks

Dear Valued Customer,

Your security is very important to us, and we want you to have a safe and positive experience with Kaspersky. 
Your personal information can be compromised by a number of online threats in today's digital environment, such as phishing, impersonation, and data theft. We have some crucial advice to give you as part of our commitment to assist you in lowering these risks. 
Here are some recommended steps to take:
1. Verify the authenticity of email messsages especially if they ask for sensitive information. 
2. Don't click on suspicious links or download attachments from unknown links. 
3. Verify the identity of anyone that contacts you on behalf of Kaspersky. You can call customer support for confirmation of identities.
4. Use only Kaspersky official websites annd applications for transactions. 
5. Use strong password and enable two factor authentication on your Kaspersky accounts.

Please don't hesitate to get in touch with our customer service team right away if you need assistance or if you detect any questionable conduct. We're here to support you and make sure you have a safe and pleasurable online experience.


Sincerely,

```


