Hunting Adversary Infrastructure
with Silent Push

Silent Push is built on two continuously updated datasets. Understanding which one you are looking at makes every pivot faster and more precise.

Before running any pivot, read the PADNS history. It tells you the full operational story of the domain: which hosting providers the actor used, in what order, and when. That history is permanent. It cannot be scrubbed by the actor rotating to new infrastructure.

Start with a domain lookup

Log into Silent Push and search montblancgroup.cfd in the search bar on the main page. This loads the total view page. Before exploring any tabs, note two fields in particular: NS Diversity and ASN Diversity. These are derived from the Passive Aggressive DNS history and tell you at a glance that this domain changed nameservers multiple times and appeared on more than one hosting provider.

Opening the A record history

Click the PADNS tab, which loads the A records. Read the table from oldest to newest. What you are looking at is the IP rotation history: every address the domain resolved to, in sequence, with the exact dates each record was first and last observed.

This is the operational timeline of the campaign. Each provider corresponds to a distinct phase: initial registration and parking, staging on a bulletproof server, proxying behind Cloudflare for the active C2 period, a transitional re-parking phase, and then a new deployment. The actor changed infrastructure multiple times, but Passive Aggressive DNS recorded every state.

The NS record history tells the same story

Switch to the NS Records sub-tab. Where the A records showed IP rotation, this view shows the nameserver rotation across four distinct configurations over the domain's lifetime. The sequence maps directly to operational phases: registrar defaults while parked, Cloudflare when active, back to registrar defaults when re-parking, then a custom provider for the latest deployment. Each row has a unique nshash, a fingerprint you will pivot on in Chapter 5.

Start every investigation by pulling a full enrichment on the seed domain. This baseline captures registration metadata, hosting history, DNS records, and the web scan fingerprints Silent Push has collected over time. Every subsequent pivot decision flows from what you find here.

Domain:     montblancgroup.cfd
Registrar:  Namecheap  (ASN 22612)
Created:    2025-03-11
TLD:        .cfd  (high-abuse zone)
Nameservers: ns1–ns4.csof.net  (recently changed, see Step 6)

Open the PADNS tab and run a forward A record lookup on the seed. This returns every IP the domain has resolved to over time, with first-seen and last-seen timestamps. Each IP is a potential pivot, but before pivoting on any address, run an NS Diversity check to determine whether the IP is dedicated actor infrastructure or a shared cloud pool.

montblancgroup.cfd  →  Full IP resolution history

  44.192.95.127    AWS us-east-1    current  (2026-05-29 → present)
  172.234.24.211   Linode                    (2026-03-11 → 2026-04-22)
  172.239.57.117   Linode                    (2026-03-11 → 2026-04-22)
  172.67.147.216   Cloudflare CDN            (2025-09-26 → 2026-03-11)
  104.21.63.165    Cloudflare CDN            (2025-09-26 → 2026-03-11)
  188.114.96.3     Cloudflare CDN            (2025-09-25 → 2025-10-14)
  162.255.119.246  Namecheap                 (2025-03-12 → 2025-09-23)
  196.251.89.33    Unknown          ←        (2025-09-24, single observation)

Two IPs stand out: 196.251.89.33, a brief early observation with no obvious owner, and 44.192.95.127, the current AWS address. Run NS Diversity on each to understand what kind of pivot each IP supports.

196.251.89.33  →  num_domains: 10      dedicated IP, every co-resident domain
                                        is likely actor-controlled  ✓
44.192.95.127  →  num_domains: 1,848   shared AWS pool, co-residence alone is
                                        not confirmation, but PADNS reverse still
                                        surfaces campaign domains via shared attributes  ✓

The PADNS reverse lookup on 196.251.89.33 returns a clean, small set of co-hosted domains, all within the same campaign window as the seed:

196.251.89.33  →  All domains resolved to this IP:

  montblancgroup.cfd      seed       (2025-09-24)
  sellea-ims.cfd                     (2025-09-24 → 2025-10-14)
  dddotx.shop                        (2025-02-16 → 2025-07-06)
  ddrtot.shop                        (2025-02-16, brief window)
  lubipumps.cam                      (2025-02-16 → 2025-03-04)
  sebel.sbs                          (2025-02-16, brief window)
  taurusfood-com-ua.cfd              (2025-02-16 → 2025-02-22)

Running the same PADNS reverse lookup on the AWS IP 44.192.95.127 returns 100+ co-hosted domains. Most are unrelated, but scanning that list for domains sharing the seed's registrar pattern and TLD surfaces celosiapatroen.shop: registered via Dynadot, pointed at csof.net nameservers, same .shop TLD family. The shared AWS IP is what finds it; the matching attributes are what confirm it. This domain becomes the anchor for the web content pivots in Steps 3 and 4.

The web scan history of montblancgroup.cfd includes a capture from October 2025 when the domain was serving a specific nginx default page titled "This is the default server vhost". Silent Push recorded the ssdeep fuzzy hash of that page body. Use this hash in the Web Search tab to find every other domain running the same server configuration.

datasource = ["webscan"] AND html_body_ssdeep = "24:n1wTfr3TuDbltxxtF1lEgZF/DemS14dq41g6AwRoVUzxx:nEXuDjAylDZS14dq4W61Rr"

This returns 7 unique domains, all confirmed members of the 196.251.89.33 staging cluster:

The web scan of celosiapatroen.shop reveals the domain serving a 39-byte empty nginx response with Content-Type: application/octet-stream and a final resolved URL of data:. This is the LokiBot C2 listener fingerprint: the server accepted a connection and returned a raw binary blob, no redirect, no page, nothing a browser can render. The url = "data:," field in Silent Push scan data captures exactly this behaviour.

The SPQL query below combines four conditions. None of them alone produces a clean result, the precision comes from their intersection:

datasource = ["webscan"] AND body_analysis.body_sha256 = "0c62c11e910d7c0d6b6c9800b70e78bfd9220e1f78bd7bb34ae4c3646d05f6e5" AND url = "data:," AND tld = ["cfd","shop"] AND geoip.asn = 14618

The query returns ~50 domains, all active AWS-hosted C2 nodes across the campaign window. Two distinct naming conventions appear in the same result set, confirming they are part of the same deployment:

The previous steps established two infrastructure signals: the csof.net nameserver set (nshash 8fbcec1929f7b0122d09640a65e76d2a) and the Dynadot registrar observed on celosiapatroen.shop. Query the WHOIS datasource to find every domain that combines both, this surfaces the full registration campaign rather than just the domains that happened to be scanned.

datasource = ["fullwhois"] AND nshash = "8fbcec1929f7b0122d09640a65e76d2a" AND registrar = "Dynadot Inc."

The query returns 50 domains, all registered through Dynadot, all pointed at csof.net nameservers, with a registration wave spanning August 2025 through March 2026:

The nameserver hash (nshash) is a Silent Push fingerprint computed from the exact set of nameservers a domain uses. The WHOIS query in Step 5 already used nshash as a filter. The NSHash pivot goes further: query the PADNS datasource directly to find domains sharing this NS set that may not yet appear in WHOIS scan data, including very recently registered or newly pointed domains.

# Pull the nshash from the NS record history of the seed:
montblancgroup.cfd  →  ns1.csof.net, ns2.csof.net, ns3.csof.net, ns4.csof.net
nshash: 8fbcec1929f7b0122d09640a65e76d2a

# PADNS reverse returns 25+ domains currently on this NS set,
# including domains registered after the last WHOIS scan cycle:
  kezxwnfgxxzuthr.com      (first seen 2026-04-27, newer than WHOIS data)
  dpmgfd35c8779c89.com
  dplni266cef04ee7.net
  yossxjbgxxkastbxneic.com
  vlgyd10dfa1945df.top
  ekmkyf95a7c94005.top
  aaefouageoeougaeol.in
  rpwwknsm.com             (active since 2022, pre-dates this campaign)