As cited
Copy frozen at (site build).
vulnerabilities
Obfuscating IP Addresses as Hostnames
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Obfuscating IP Addresses as Hostnames
Attackers are circumventing IP address blocklists designed to prevent Server Side Request Forgery (SSRF) exploits by using hostnames that resolve to restricted IP addresses like 169.254.169.254. Services such as nip.io, sslip.io, and 1u.ms allow adversaries to dynamically create hostnames that obfuscate target IPs, making hostname-based IP filtering ineffective. Organizations can detect such activity by reviewing DNS logs for resolutions that map to sensitive IP addresses.
Why it matters: Security teams blocking specific IP addresses from SSRF attacks need to extend controls to hostname-level filtering and review DNS logs, since attackers now routinely use wildcard hostname services to bypass IP blocklists.
- Source published
- First seen by Cybersecurity Tracker