Infrastructure Pivoting

#!/usr/bin/env python3
"""
Infrastructure pivoting from a single C2 IP
Using: crt.sh (CT logs), VirusTotal pDNS, WHOIS
"""
import requests
import json
import time

def crt_sh_domains(ip_or_domain):
    """Find all certificate SANs for domains on this IP via crt.sh"""
    url = f"https://crt.sh/?q={ip_or_domain}&output=json"
    r = requests.get(url, timeout=15)
    if r.status_code == 200:
        certs = r.json()
        domains = set()
        for c in certs:
            # name_value may contain multiple SANs separated by newlines
            for d in c.get('name_value', '').split('\n'):
                d = d.strip().lstrip('*.')
                if d and '.' in d:
                    domains.add(d)
        return sorted(domains)
    return []

def vt_resolutions(ip, api_key):
    """Get passive DNS resolutions from VirusTotal"""
    url = f"https://www.virustotal.com/api/v3/ip_addresses/{ip}/resolutions"
    headers = {"x-apikey": api_key}
    r = requests.get(url, headers=headers, params={"limit": 40}, timeout=15)
    if r.status_code == 200:
        return [item['attributes']['host_name']
                for item in r.json().get('data', [])]
    return []

# Pivot from C2 IP
C2_IP = "185.220.101.47"
VT_KEY = "your-api-key-here"  # Replace with real key

print(f"=== Infrastructure Pivot: {C2_IP} ===\n")

print("[1] Certificate Transparency domains:")
ct_domains = crt_sh_domains(C2_IP)
for d in ct_domains[:20]:
    print(f"  {d}")

time.sleep(1)  # Rate limit

print(f"\n[2] Passive DNS resolutions (VirusTotal):")
pdns = vt_resolutions(C2_IP, VT_KEY)
for d in pdns[:20]:
    print(f"  {d}")

# Combine all domains found
all_domains = set(ct_domains + pdns)
print(f"\n[Summary] Total unique domains found: {len(all_domains)}")

# Save for further investigation
with open("/cases/CASE-2026-009/attribution/infrastructure.json", "w") as f:
    json.dump({"seed_ip": C2_IP, "related_domains": sorted(all_domains)}, f, indent=2)