A regional hospital SOC escalates a ransomware alert after several workstations beacon to 185.x.x.x on TCP 443. The IP resolves to a six-month-old domain, carries a Let's Encrypt certificate issued last week, and scores “malicious” in two threat feeds. An analyst drafts a ticket to quarantine the entire /24. Twenty minutes later, the same prefix shows legitimate SaaS tenants in NetFlow, and the help desk reports that a partner clinic's VPN drops whenever the block lands. The IP was rented, shared, and already rotated by the time the ticket reached change control.
That pattern keeps repeating as ransomware volume climbs, OAuth phishing kits rotate callback hosts, and Magecart-style script hijacks (including analytics loaders similar to the Convertr case) park payment skimmers on short-lived IPs. Public OSINT remains essential. Treating one passive DNS or reputation hit as proof of attacker ownership is how teams overblock, under-attribute, and lose the trail.
Start from the alert artifact, not the vendor label
Open every IP case with three fields you already own: first-seen time in your logs, the protocol and destination port, and the internal host or service that talked to it. For ransomware staging, join those fields to process trees and proxy downloads within the same hour. For OAuth or consent-phishing callbacks, join the IP to IdP sign-in anomalies and redirect URLs. For card-skimming scripts, join it to the Referer, page path, and content hash of the injected loader.
Write the working hypothesis as a sentence you can falsify. Example: “This IP is attacker-controlled C2 for the current hospital intrusion.” Everything you collect next either supports, weakens, or splits that claim into “compromised legitimate host” versus “dedicated malicious lease.”
Run a fixed OSINT sequence that survives disagreement
When reputation, certificates, and hosting tenure disagree, work in this order so later evidence does not erase earlier context.
1. Tenure and routing
Pull current BGP announcement, parent ASN, and how long the prefix has been advertised under that ASN. Note whether the IP sits in a cloud, VPS, residential, or mobile ASN. Residential and mobile prefixes often appear in AI-assisted crime tooling and short malware delivery windows, including campaigns that abuse external collaboration chats for rapid payload handoff. Treat those sources as likely proxies until tenancy evidence says otherwise.
2. Historical name bindings
Query passive DNS for the IP across at least 90 days. Record every hostname, first and last seen, and whether names look like brand lookalikes, random labels, or known SaaS patterns. A single fresh A record on a newly registered domain is a lead. It is not ownership. Shared hosting and CDN edges bind many unrelated names to the same address.
3. Certificate and TLS evidence
Collect current and historical certificates from Certificate Transparency and any TLS handshake you can safely capture from your own sensors. Compare Subject Alternative Names, issuer, validity window, and reuse across other IPs. Ransomware C2 and OAuth lure kits frequently reuse certificate issuers and short validity windows. Payment-skimmer operators often place valid TLS on brand-adjacent hostnames. Valid TLS raises confidence that a victim will trust the host. It does not prove the operator owns the network path.
4. Reverse DNS, WHOIS, and abuse contacts
Capture PTR, org name, abuse mailbox, and any privacy-redacted fields. Privacy redaction still leaves ASN, allocation type, and abuse path. For diplomatic or APT-style activity (including bootkit revival patterns such as BlackLotus reuse by groups like APT41), expect layered VPS and bulletproof-adjacent providers. For opportunistic ransomware against health systems, expect commodity VPS that churn weekly.
5. Peer and neighbor context
Map sibling IPs in the same /24 or advertised prefix that appear in your honeypots, blocklist deltas, or industry sharing. Score whether neighbors show the same campaign stage: exploit scouting, credential phishing, or C2 beaconing. Shared tooling across OAuth lures and email bombs often leaves neighbor IPs with matching JA3, URI templates, or mail-bomb cadence even when hostnames differ.
Classify the IP before you widen the block
Force every case into one of four buckets before you escalate scope.
- Dedicated malicious lease: short tenure, sparse legitimate passive DNS, certificate and hostname reuse with known kits, little or no clean customer traffic in your own logs.
- Compromised legitimate host: long-lived site or service, mixed clean and malicious content or unexpected listeners, abuse contact belongs to a real organization with a repair path.
- Shared or proxy egress: cloud, CDN, residential proxy, or VPN ASN with many unrelated tenants; your malware talks through it while partner or customer traffic may share the same address.
- Misattribution / recycled address: reputation hit older than current WHOIS or BGP state, or blocklist entry that predates a reallocation; treat as hunt seed, not automatic deny.
UNM Health-style ransomware disruption shows why this classification matters operationally. Blocking a shared cloud prefix that also carries telehealth or imaging partners can halt care as effectively as the malware. Classify tenancy first, then choose IP, prefix, ASN, or domain controls.
Detection steps you can run in one analyst shift
- Export every internal connection to the suspect IP for the last 72 hours: user, host, process if available, bytes, SNI or Host header.
- Diff passive DNS and CT for that IP against the same data for its /24 siblings.
- Check whether the IP appears only as a destination from infected endpoints, or also as a source against your edge (scanners, auth spray, script probes).
- If the alert came from a Teams or other chat-delivered lure, pull the message timestamp and compare it to the IP's certificate not-before and domain creation time. Delivery windows under 15 minutes leave thin but sharp OSINT: new cert, new domain, old ASN.
- For OAuth-related IPs, capture the full redirect chain and token endpoint host. Map each hop separately; the lure page IP and the token thief IP often diverge.
- For script-injection payment theft, hash the remote script body and search your web logs for the same hash on other pages. Infrastructure rotates faster than payload families.
Response actions that match the bucket
Dedicated malicious lease: block the IP and closely related siblings with matching cert or hostname patterns. Open a hosting abuse ticket with BGP, reverse DNS, certificate, and your traffic sample. Keep a time-boxed allow only if a critical business dependency collides, and schedule the allow for retirement within the shift.
Compromised legitimate host: contain endpoints, preserve evidence, and notify the owner through the abuse contact with enough IOCs for them to clean the box. Prefer domain and URL blocks plus endpoint isolation over a wide prefix drop until tenancy is confirmed.
Shared or proxy egress: prioritize host isolation, DNS sinkholing of attacker domains, and IdP or session revocation. Cap or challenge the ASN only on the paths that actually carry the risk (auth, RMM, admin portals), and leave partner corridors documented.
Misattribution / recycled address: seed retrospective hunts across allow logs and proxy history. Retire stale blocklist automations that still reference the old allocation. Update the case notes so the next analyst does not re-block a cleaned tenant.
What belongs in the escalation packet
When leadership or a hosting desk asks for proof, send a short packet: first/last seen in your environment, classification bucket, ASN and prefix tenure, passive DNS summary, certificate SANs and dates, sample HTTP or TLS metadata with secrets redacted, and the business impact of a proposed block. Add a single line on related news context when useful, such as active ransomware pressure on healthcare or known OAuth consent-lure patterns, so responders understand urgency without waiting for perfect attribution.
Takeaways for the next alert IP
- Anchor OSINT to your own telemetry timestamps before you trust a feed label.
- Sequence routing, passive DNS, certificates, WHOIS, and neighbor context in that order.
- Classify dedicated, compromised, shared, or recycled before widening from one IP to a prefix or ASN.
- Match containment to the bucket so ransomware and skimmer response does not collateralize partners.
- Ship partial evidence upstream early; attacker leases move while perfect ownership debates continue.
A fresh passive DNS hit is a strong invitation to investigate. Ownership, tenancy, and safe response still come from corroboration you can defend under change control.
