<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: analyzing-exploit-kit-infrastructure
description: >-
  Map and analyze exploit kit infrastructure including landing pages, gate servers,
  traffic distribution systems (TDS), payload delivery chains, and exploit kit
  fingerprinting. Covers URL pattern analysis, HTTP header profiling, and
  infrastructure pivot techniques for threat intelligence.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - exploit-kits
  - infrastructure-analysis
  - tds
  - malvertising
  - url-analysis
  - traffic-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1583", "T1189"]
---
# Analyzing Exploit Kit Infrastructure

## Overview

Exploit kit infrastructure analysis maps the delivery chain from initial redirect
through traffic distribution systems (TDS) to exploit landing pages and payload
delivery. This skill covers identifying EK fingerprints via URL patterns and HTTP
headers, mapping gate server networks, analyzing TDS redirect logic, and pivoting
across infrastructure to identify operator clusters.

## Prerequisites

- Python 3.10+ with `requests`, `beautifulsoup4`, `tldextract`, `shodan` libraries
- urlscan.io API key for URL submission and analysis
- Shodan API key for infrastructure reconnaissance
- Access to passive DNS data (SecurityTrails, DNSDB, or similar)
- Proxy/VPN for safe browsing of suspicious infrastructure

```bash
pip install requests beautifulsoup4 tldextract shodan
```

## Key Concepts

### Exploit Kit Delivery Chain

```
Compromised Site → Gate/Redirector → TDS → EK Landing Page → Exploit → Payload
```

Each stage has distinct indicators:
- **Compromised sites**: injected iframes/scripts, often WordPress/Joomla
- **Gate servers**: HTTP 302 chains, short-lived domains, geo-filtering
- **TDS**: traffic distribution based on browser/OS/geo, cookie tracking
- **Landing page**: obfuscated JavaScript, vulnerability probing, conditional exploit delivery
- **Payload**: final malware download, often encrypted/encoded

### EK Fingerprinting

| Exploit Kit | URL Pattern | Landing Page Indicator |
|-------------|-------------|----------------------|
| RIG EK | `/gate.php?`, random path segments | Obfuscated VBScript, Flash exploits |
| Magnitude | Base64 in URL path | iframe chain, conditional redirects |
| Fallout | `/redirect.php`, geo-fenced | PowerShell cradle delivery |
| Spelevo | Short random paths + `.php` | IE/Flash targeting, minimal JS |

### Infrastructure Pivot Techniques

- **WHOIS registrant**: same registrant email across domains
- **Passive DNS**: shared IP history reveals co-hosted infrastructure
- **TLS certificates**: certificate reuse, shared SANs, Let's Encrypt patterns
- **HTTP headers**: unique server signatures, custom headers, framework fingerprints
- **ASN clustering**: bullet-proof hosting providers, same /24 subnet patterns

## Workflow


### Step 1: URL Pattern Analysis

```python
import tldextract
from urllib.parse import urlparse, parse_qs

def analyze_url_chain(urls: list[str]) -> list[dict]:
    """Analyze redirect chain URLs for EK indicators."""
    results = []
    for url in urls:
        parsed = urlparse(url)
        ext = tldextract.extract(url)
        params = parse_qs(parsed.query)
        results.append({
            "url": url,
            "domain": f"{ext.domain}.{ext.suffix}",
            "subdomain": ext.subdomain,
            "path": parsed.path,
            "params": {k: v[0] for k, v in params.items()},
            "indicators": detect_ek_patterns(parsed.path, params),
        })
    return results

def detect_ek_patterns(path: str, params: dict) -> list[str]:
    """Detect exploit kit URL patterns."""
    indicators = []
    if "gate.php" in path:
        indicators.append("RIG_EK_gate")
    if any(len(v[0]) > 50 for v in params.values() if v):
        indicators.append("base64_encoded_param")
    if path.count("/") > 4:
        indicators.append("deep_path_redirect")
    return indicators
```

### Step 2: Infrastructure Reconnaissance

```python
import shodan

def scan_ek_infrastructure(api_key: str, ip: str) -> dict:
    """Scan suspected EK infrastructure via Shodan."""
    api = shodan.Shodan(api_key)
    host = api.host(ip)
    return {
        "ip": ip,
        "org": host.get("org", ""),
        "asn": host.get("asn", ""),
        "ports": host.get("ports", []),
        "hostnames": host.get("hostnames", []),
        "vulns": host.get("vulns", []),
        "ssl": {
            "cert_subject": host.get("ssl", {}).get("cert", {}).get("subject", {}),
            "cert_issuer": host.get("ssl", {}).get("cert", {}).get("issuer", {}),
        },
        "http_headers": host.get("http", {}).get("headers", {}),
    }
```

### Step 3: Passive DNS Pivoting

```python
import requests

def passive_dns_lookup(domain: str, api_key: str) -> list[dict]:
    """Query SecurityTrails for passive DNS history."""
    resp = requests.get(
        f"https://api.securitytrails.com/v1/domain/{domain}/subdomains",
        headers={"APIKEY": api_key},
        timeout=30,
    )
    if resp.status_code != 200:
        return [{"error": f"HTTP {resp.status_code}"}]
    data = resp.json()
    return [
        {"subdomain": f"{sub}.{domain}"}
        for sub in data.get("subdomains", [])
    ]

def reverse_ip_lookup(ip: str, api_key: str) -> list[dict]:
    """Find all domains hosted on an IP address."""
    resp = requests.get(
        f"https://api.securitytrails.com/v1/ips/nearby/{ip}",
        headers={"APIKEY": api_key},
        timeout=30,
    )
    return resp.json().get("blocks", []) if resp.status_code == 200 else []
```

### Step 4: Landing Page Analysis

```python
from bs4 import BeautifulSoup
import requests

def analyze_landing_page(url: str, proxies: dict | None = None) -> dict:
    """Analyze suspected EK landing page content."""
    resp = requests.get(url, proxies=proxies, timeout=15, allow_redirects=False)
    soup = BeautifulSoup(resp.text, "html.parser")

    iframes = [iframe.get("src", "") for iframe in soup.find_all("iframe")]
    scripts = [s.get("src", "") for s in soup.find_all("script") if s.get("src")]
    inline_js = [s.string[:200] for s in soup.find_all("script") if s.string]

    return {
        "status_code": resp.status_code,
        "headers": dict(resp.headers),
        "iframes": iframes,
        "external_scripts": scripts,
        "inline_js_count": len(inline_js),
        "obfuscation_indicators": detect_obfuscation(inline_js),
    }

def detect_obfuscation(scripts: list[str]) -> list[str]:
    """Detect JavaScript obfuscation techniques."""
    indicators = []
    for s in scripts:
        if s and "eval(" in s:
            indicators.append("eval_usage")
        if s and "String.fromCharCode" in s:
            indicators.append("char_code_encoding")
        if s and "unescape(" in s:
            indicators.append("unescape_decoding")
    return indicators
```

## Detection

```yaml
title: Exploit Kit Infrastructure Detection
id: 9083e8b2-8ba9-4d46-8c71-c18b6fd7f063
status: experimental
description: Detects suspicious activity related to analyzing exploit kit infrastructure techniques in threat intelligence context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1583
  - attack.t1189
  - attack.reconnaissance
falsepositives:
  - Threat intelligence platform aggregating feeds from approved sources
```

## Verification

- [ ] URL redirect chains analyzed with EK pattern detection
- [ ] Infrastructure scanned via Shodan with ASN and certificate data
- [ ] Passive DNS pivoting reveals related domains and hosting patterns
- [ ] Landing page analysis detects obfuscation and iframe injection
- [ ] Infrastructure map produced linking gate servers, TDS, and landing pages
- [ ] Findings documented with IOCs exportable to MISP/OpenCTI

## References

- [urlscan.io](https://urlscan.io/)
- [Shodan](https://www.shodan.io/)
- [SecurityTrails](https://securitytrails.com/)
- [Exploit Kit Tracking (Malware Traffic Analysis)](https://www.malware-traffic-analysis.net/)
- [tldextract Library](https://github.com/john-kurkowski/tldextract)
