Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)
2026-08-26T01:23:41Z•ba9e3cf33f62c8a8879ec5663e18f92f68e0a638086dc603ad59e54f88d7c1ab
169.254.169.254DOUBLECUPEntra IDMFAMicrosoft 365Microsoft GraphPNG payloadPowerShellSSRFURL filteringcloud identity monitoringcloud metadata servicehostname obfuscationpassword sprayingrisky sign-inssteganography
What happened
SANS Internet Storm Center entries covering SSRF defenses and evasion through hostname representations of cloud metadata IPs, DOUBLECUP PNG-based payload delivery, Microsoft Graph and PowerShell automation for Entra/Microsoft 365 account and license inventory, risky-login detection, MFA rollout gaps, and password-spray monitoring. The collection is primarily defensive guidance and threat-awareness content; no specific CVE is identified.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- ba9e3cf33f62c8a8879ec5663e18f92f68e0a638086dc603ad59e54f88d7c1ab
- Enrichment time
- 2026-08-26T01:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.