Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)

The threat involves attackers substituting the IP address 169.254.169.254, which is commonly targeted in SSRF attacks against cloud metadata services, with various hostname representations such as 169.254.169.254.nip.io or 169-254-169-254.sslip.io. These hostnames resolve to the same IP but evade filters that block direct IP address strings. Tools like 1u.ms facilitate dynamic hostname generation with configurable IP address changes and encoding, allowing attackers to bypass static blocklists. DNS logs can be used to detect such resolutions, but simple IP string filtering is insufficient.

This technique undermines IP-based filtering controls intended to block SSRF exploitation attempts against cloud metadata services. It increases the risk of unauthorized access to sensitive cloud metadata by evading naive blocklists. However, no active exploitation or widespread attacks are reported in the wild at this time.

Blocklists based solely on the IP string 169.254.169.254 are insufficient. Defenders should monitor DNS logs for resolutions to this IP address, including obfuscated hostnames. Implement more robust SSRF protections that do not rely solely on IP or hostname filtering. Review and enhance application logic to validate and restrict outbound requests to trusted destinations. Check public logs at 1u.ms for potential abuse against your systems.