{"id":16243,"date":"2025-10-07T12:55:48","date_gmt":"2025-10-07T12:55:48","guid":{"rendered":"\/cybersecurity-blog\/?p=16243"},"modified":"2026-02-26T12:56:26","modified_gmt":"2026-02-26T12:56:26","slug":"osint-in-threat-intelligence-lookup","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/osint-in-threat-intelligence-lookup\/","title":{"rendered":"Phishing, Cloud Abuse, and Evasion: Advanced OSINT Investigation with ANY.RUN Threat Intelligence\u00a0"},"content":{"rendered":"\n

Editor\u2019s note:\u00a0The current article is authored by Clandestine, threat researcher and threat hunter. You can\u00a0<\/em><\/strong>find Clandestine on X<\/em><\/strong><\/a>.<\/em><\/strong>\u00a0<\/p>\n\n\n\n

ANY.RUN\u2019s Threat Intelligence (TI) Lookup<\/a> is a powerful service for Open Source Intelligence (OSINT) and Threat Intelligence investigations. In this research, we shall analyze 5 specific queries, each targeting different aspects of the threat landscape, to better understand the nature of modern threats as well as defense and response strategies.  <\/p>\n\n\n\n

Key Findings <\/h2>\n\n\n\n
    \n
  1. JA3S Fingerprinting<\/strong> underscores the value of behavioral indicators in hunting advanced threats allowing analysts to track Command and Control infrastructure even when attackers rotate IP addresses and domains\u00a0<\/li>\n<\/ol>\n\n\n\n
      \n
    1. Massive abuse of legitimate infrastructure<\/strong> (AWS, Google Cloud, Cloudflare, Microsoft services) complicates detection, as malicious traffic blends with legitimate services.\u00a0<\/li>\n<\/ol>\n\n\n\n
        \n
      1. Locally targeted phishing operations<\/strong> demonstrate that attackers tailor their strategies by geography. This highlights the importance of localized cyber threat intelligence.\u00a0<\/li>\n<\/ol>\n\n\n\n
          \n
        1. By combining sandbox detonation with TI Lookup queries<\/strong>, analysts uncover trojan traffic disguised within HTTPS (port 443). This methodology proves the benefit of correlating behavioral analysis with IOC-based searches.\u00a0<\/li>\n<\/ol>\n\n\n\n
            \n
          1. The .top domain extension<\/strong> serves as a thriving ecosystem for cybercrime, with randomly-generated DGA domains used for malware delivery, often leveraging WinRAR for payload extraction.\u00a0<\/li>\n<\/ol>\n\n\n\n

            Exploring Beyond IOCs: Malicious Pattern Case Studies  <\/h2>\n\n\n\n

            ANY.RUN\u2019s Threat Intelligence (TI) Lookup<\/a> is a dynamic, searchable database that equips security analysts with immediate access to over 50 million Indicators of Compromise (IOCs), Behavior (IOBs), and Attack (IOAs)<\/a> and threat events extracted from real-time malware sandbox analyses conducted by a global community of over 500,000 analysts and 15,000 companies.  <\/p>\n\n\n\n

            Tailored for threat hunting, alert triage, and incident response, it allows analysts to query the database using more than 40 parameters \u2013 including hashes, IPs, registry keys, processes, and TTPs. It supports search operators, wildcards, YARA and Suricata rules, and notifies on updates on saved searches.  <\/p>\n\n\n\n

            Let\u2019s see how analysts can use it as part of their OSINT investigation. <\/p>\n\n\n\n

            Case 1: Investigating Regionalized Phishing Campaigns <\/h3>\n\n\n\n

            Query<\/strong>: threatName:”Phishing” AND submissionCountry:”br” and domainName:””<\/a> <\/p>\n\n\n

            \n
            \"\"
            Examples of phishing encountered by Brazilian users<\/em>\u00a0<\/figcaption><\/figure><\/div>\n\n\n

            We can start by checking for active phishing campaigns targeting organizations in our region. Even with a free plan<\/a>, TI Lookup provides us with lots of sandbox analyses of the latest malicious domains and emails sent to companies in Brazil.  <\/p>\n\n\n\n\n

            \n\n

            \nEnrich alerts and detection rules with actionable threat intel
            \nTriage threats faster, respond to incidents with confidence<\/span>   \n<\/p>\n\n            \nTry TI Lookup \n<\/a>\n<\/div>\n\n\n\n