When the delivery host still scores clean
In September 2026, defenders watching perimeter feeds saw a familiar pattern collide with a harder one. Public scanners kept hitting hospitality booking and property apps, Chinese surveillance-camera access kept trading in underground markets, and ISC Stormcast coverage on September 17 kept teams focused on fast-moving edge noise. At the same time, the Brevo supply-chain incident showed ClickFix-style scripts landing on customer sites through infrastructure that still looked reputable to many IP blocklists.
That combination is the practical problem for SOC and IT teams. Blocklists remain useful. They name repeat scanners, known C2 exits, and recycled botnet nodes. Supply-chain and living-off-platform campaigns often deliver from addresses that reputation systems still treat as ordinary SaaS, CDN, or marketing mail paths. If your hunt queue only opens after an address appears on an abuse list, you start after users already ran the script.
What recent waves actually look like in telemetry
Treat the Brevo-linked ClickFix pattern as a chain, not a single bad IP. Marketing or customer-site JavaScript loads from a trusted platform or compromised page. The page instructs the user to paste a command or open a verification step. Secondary fetches go to short-lived payload hosts, paste sites, or cloud object storage. Only some of those later nodes ever join public blocklists, and often after the first employee cohort already executed.
Hospitality application scans reported in mid-September add a second telemetry shape. Probe sources rotate across VPS providers and residential proxies. They fingerprint login portals, booking engines, and remote support paths. A subset of those sources eventually lands on shared scanner lists. The huntable signal is the successful application response or authentication attempt that happened while the source was still unmarked.
Camera-botnet sales create a third shape inside enterprise networks. Listed IoT botnet members try default credentials and exposed management ports. Your internal cameras, DVRs, and forgotten lab devices answer on the same protocols. Cross-environment pivot work inside modern SOCs matters here: a listed external IP that only appears in firewall drops is one case. The same family of traffic that reaches an unmanaged VLAN and then leaps into corporate identity systems is the hunt that protects the business.
Log fields worth normalizing before you enrich
Before you join any blocklist, normalize a short set of fields across proxy, DNS, firewall, VPN, and host telemetry:
- Source and destination IP plus port, with NAT and load-balancer originals preserved when available
- HTTP host, URL path, user-agent, and referer for web and API edges
- TLS SNI and certificate subject when HTTPS inspection or passive TLS logs exist
- Process, parent process, and command line on endpoints that executed pasted or downloaded content
- Identity context: user, device, MFA result, and session start for any admin or VPN path
Silver Fox style C2 panels that move from broad callbacks toward operator-maintained deny logic for researchers and sandboxes are a reminder that attacker infrastructure also maintains lists. Your enrichment should record whether a destination answered, redirected, or returned an empty body, because those application outcomes separate live staging from scavenged historical listings.
How a blocklist match should open a hunt
Use the list hit as a pivot key, then expand along time and relationship, not along deny-rule satisfaction.
- Replay a fixed pre-listing window for that address and its /24 or adjacent cloud neighbors that shared the same JA3, user-agent, or URL path. For scanner waves against hospitality apps, twenty-four to seventy-two hours of edge and WAF logs usually recovers the first successful probes.
- Separate delivery IPs from action IPs. In ClickFix and supply-chain cases, the address that later hits an abuse feed is often a redirect or payload mirror. Hunt the earlier referer hosts, CMS plugin origins, and marketing-platform script URLs that still carry clean reputation.
- Join outbound employee or server sessions to the same indicators. Firewall drops prove perimeter policy. Proxy 200s, DNS resolutions followed by TLS handshakes, and endpoint process trees prove contact.
- Score by asset criticality. A listed IoT botnet member talking to a guest Wi-Fi camera is triage. The same pattern reaching a jump host, VPN portal, or hypervisor console becomes an immediate containment hunt.
- Keep delisted and aged entries in a cool-down queue. Operators recycle panels. A thirty-day soft queue for prior C2 and payload hosts catches reactivations that fresh-only alerting misses.
Concrete example: ClickFix after a clean script host
Assume users report a browser prompt telling them to open Run and paste a verification command after visiting a vendor status page. Proxy logs show the page loaded a third-party script from a marketing SaaS range. Endpoint telemetry shows mshta, powershell, or clipboard-assisted command execution within minutes. Days later, one payload IP appears on a public blocklist.
Immediate hunt steps:
- Extract every distinct script URL and SNI from the original page view, including platform CDN hostnames that remain unlisted
- Search fleet-wide for those URLs, hash values, and parent-child process pairs for the prior seven days
- Pull mail and chat messages that carried the same vendor link so you can measure who clicked before the first host alert
- Tag the later blocklisted payload IP as secondary evidence, then block and monitor neighbors that served identical paths
Concrete example: hospitality probe that later hits a scanner list
WAF logs show repeated GET and POST sequences against /admin, booking APIs, and remote support URLs from changing cloud exits. One exit joins a community scanner blocklist two days later. Replay shows three earlier sessions received HTTP 200 on a forgotten staging vhost with weak credentials. Identity logs then show the same username from a VPN session outside the hotel staff schedule. The blocklist entry validates the source family. The successful staging login defines the incident.
Controls that should fire the same day
Map the hunt findings into controls that reduce dwell without waiting for every feed to agree.
- Script integrity on customer-facing and vendor pages: subresource integrity where possible, CSP that limits unexpected script hosts, and change alerts on marketing tag managers
- Endpoint policies that catch ClickFix behavior: block or alert on unusual Run/Terminal paste chains, constrain script hosts that spawn networking tools, and capture clipboard-to-shell sequences in EDR
- Application-aware edge rules for industry scan paths: rate and geo policies on hospitality admin and booking surfaces, plus honeytoken accounts that convert anonymous probes into high-confidence tickets
- IoT and camera segmentation: deny default outbound from camera VLANs, force management through jump hosts, and alert when internal devices talk to addresses already on botnet lists
- Blocklist pipeline hygiene: ingest lists into a detection bus that opens hunt cases, while enforcement lists stay narrower and human-reviewed for SaaS and partner ranges that false-positive easily
For cross-environment pivots, require identity correlation on every blocklist-backed case that touches VPN, cloud admin, or hypervisor consoles. An IP match alone is incomplete when the attacker goal is session reuse across on-prem and SaaS.
Operating cadence for IT and SOC together
IT administrators own inventory and exception debt. Security owns enrichment and case quality. A workable weekly rhythm looks like this:
- Publish the top twenty newly listed addresses that touched production DNS or proxy, ranked by successful responses rather than hit count
- IT confirms which of those destinations sit in approved SaaS, CDN, or partner ranges and documents temporary allows with an expiry
- SOC runs the pre-listing replay and endpoint join for any allow that coincided with script loads, auth failures, or admin path access
- Both teams retire exceptions that coincide with ClickFix, scanner success, or IoT callback behavior
That cadence keeps blocklists honest. They remain a shared language for known-bad infrastructure while hunts focus on clean-looking delivery paths, successful handshakes, and pivots your deny rules never saw.
Takeaways you can apply this week
- Open supply-chain and ClickFix hunts from script hosts and process trees first; treat later blocklisted payload IPs as corroboration
- Replay edge and WAF logs for scanner IPs before and after listing, and escalate any successful admin or staging responses
- Join camera and IoT callback lists to internal asset inventories so listed botnet members map to devices you can isolate
- Feed blocklist matches into hunt tickets with identity context when VPN, cloud, or console paths appear in the same window
- Keep enforcement lists conservative on major SaaS ranges while detection lists stay broad enough to catch recycled neighbors
Threat hunting with IP blocklists works when the list hit is a starting key into sessions, scripts, and assets. In a month defined by ClickFix on trusted platforms, hospitality scan waves, and traded camera access, the teams that win are the ones who hunt the clean addresses in the chain with the same urgency they give the listed ones.
