1. Enumerate subdomains via Certificate Transparency

title: "I Found Hidden C&C Infrastructure in a 'Proxy Detection' Service"

date: 2025-10-24

author: Patrick Duggan

category: Security Operations

tags: #Layer3Intel #C2Infrastructure #OWASP #RedTeam #CertificateTransparency #Tripwire #ProxyDetection

excerpt: After receiving a sales pitch from a convicted DDoS operator, I analyzed his "proxy detection" service. Found 3 hidden backend subdomains, WebSocket bypassing Cloudflare, and infrastructure that looks exactly like what residential proxy operators use. Here's the full technical breakdown.

**TL;DR:** A proxy detection service using proxy evasion techniques.

Context

Yesterday I published: ["I Caught the Guy Who Attacked Brian Krebs. He's Selling the Solution Now."](https://www.dugganusa.com/post/i-caught-the-guy-who-attacked-brian-krebs-he-s-selling-the-solution-now)

Someone scraped my site using residential proxies. I published the threat intelligence report. He emailed me the same day to sell his proxy detection service.

**Today:** I analyzed his infrastructure.

**What I found:** Classic C&C architecture hidden in plain sight.

Discovery Method: Certificate Transparency Logs

Certificate Transparency is public. Anyone can query it.

**Results:**

Three hidden backend subdomains. Let's test them.

queue.layer3intel.com - The Job Queue

**Finding:** Active endpoint requiring Bearer authentication.

**Question:** Why does a "proxy detection service" need a job queue with Bearer auth?

**Possible answers:**

1. **Legitimate:** Customer analytics, audit logging, service monitoring

2. **Suspicious:** C&C job tasking, data collection aggregation

3. **Very suspicious:** Command & control endpoint for distributed operations

I don't know which. I just know it's there, it's hidden from docs, and it requires authentication.

The WebSocket Pattern

From analyzing `tripwire.min.js` (their CDN-distributed code):

Architecture Flow:

**Key finding:** The core detection functionality connects DIRECTLY to OVH server, bypassing Cloudflare CDN.

**Why this matters:** Cloudflare can't log WebSocket traffic it doesn't see.

The Irony: Proxy Evasion Techniques

Let me show you what residential proxy operators do to avoid detection:

**Residential Proxy Operator Playbook:**

- ✓ Bypass CDN logging (use direct IP connections)

- ✓ Use WebSocket (harder to inspect than HTTPS)

- ✓ Hide backend infrastructure (minimize exposure)

- ✓ Use budget VPS (OVH, not AWS/Azure/GCP)

- ✓ Minify code without source maps (obfuscation)

- ✓ Keep source code private (no GitHub repo)

**What Layer3 Tripwire Does:**

- ✅ Bypasses Cloudflare CDN (WebSocket → OVH directly)

- ✅ Hides backend subdomains (queue, chronicle, spectacle)

- ✅ Uses budget VPS (OVH US LLC @ 135.148.137.76)

- ✅ Minified code, no source maps

- ✅ No GitHub repository (100% proprietary)

- ✅ Private source code (minified JavaScript only)

**A proxy detection service using the same operational security as proxy operators.**

OWASP Analysis

A01:2021 – Broken Access Control

**Finding:** `queue.layer3intel.com` exposed with HTTP 401

**Risk:**

- Backend endpoint enumerable via Certificate Transparency

- Bearer auth reveals architecture to attackers

- Can attempt token brute force (no visible rate limiting)

A05:2021 – Security Misconfiguration

**Finding:** Hidden subdomains revealed via Certificate Transparency logs

**Impact:**

- `queue.layer3intel.com` - job queue endpoint

- `chronicle.layer3intel.com` - data logging endpoint?

- `spectacle.layer3intel.com` - admin dashboard?

**Recommendation:** Separate internal/external DNS, use wildcard certs strategically

A09:2021 – Security Logging and Monitoring Failures

**Finding:** WebSocket bypasses Cloudflare CDN

**Impact:**

- Cloudflare Analytics shows JavaScript delivery from CDN

- Cloudflare Analytics CANNOT see WebSocket traffic to OVH

- No CDN access logs for actual proxy detection traffic

**The irony:** A proxy detection service avoiding detection by its own CDN provider.

Infrastructure Comparison: DugganUSA vs Layer3 Intel

I audited my own infrastructure to make sure I'm not doing the same thing.

Certificate Transparency Check (dugganusa.com):

Hidden Backend Endpoints?

**No 401 Bearer auth endpoints. No hidden job queues. No WebSocket C&C.**

GitHub Repository?

✅ **Public:** https://github.com/pduggusa/enterprise-extraction-platform

- Full source code (microservices, scripts, patterns)

- CLAUDE.md architecture documentation

- Infrastructure costs documented ($77/month)

- All subdomains explained

WebSocket Usage?

**We're clean.**

The Transparency Scorecard

| Metric | DugganUSA | Layer3 Intel |

|--------|-----------|--------------|

| **GitHub Repository** | ✅ Public | ❌ None |

| **Source Code** | ✅ Available | ❌ Minified only |

| **Hidden Subdomains** | ⚠️ 1 legacy (explained) | 🚨 3 active (unexplained) |

| **WebSocket Usage** | ✅ None | 🚨 Yes (bypasses CDN) |

| **Hidden Auth Endpoints** | ✅ None | 🚨 queue.layer3intel.com |

| **CDN Bypass** | ✅ All traffic logged | 🚨 WebSocket bypasses |

| **Infrastructure Costs** | ✅ Documented ($77/month) | ❌ Unknown (~$50-90/month) |

Flow Diagrams

What They Show You (Public Documentation):

Simple, right?

What's Actually Happening (What We Found):

The Attack Chain

**STEP 1: Initial Load**

- User visits site with Tripwire integration

- Browser requests: `https://cdn.layer3intel.com/tripwire.min.js`

- Cloudflare CDN serves minified JavaScript

**STEP 2: WebSocket C&C Connection**

- `tripwire.min.js` opens WebSocket: `wss://tripwire.layer3intel.com/ws`

- Connection bypasses Cloudflare (direct to OVH 135.148.137.76)

- Encrypted WSS tunnel established

**STEP 3: Challenge/Response**

- Server → Client: `"1234"` (random number)

- Client → Server: `"1235"` (number + 1)

- Server validates math

**STEP 4: Token Generation**

- Server → Client: JWT token

- Token contains: proxy detection result + fingerprinting data?

- JavaScript fires event: `tripwire:success`

**STEP 5: Backend Communication (Hypothesis)**

- Backend sends data to `queue.layer3intel.com` (job queue)

- Data logged in `chronicle.layer3intel.com` (database?)

- Admin monitors via `spectacle.layer3intel.com` (dashboard?)

My Questions

**To Layer3 Intel:**

1. **What is queue.layer3intel.com for?**

Why does proxy detection need a Bearer-authenticated job queue?

2. **Why bypass Cloudflare for WebSocket?**

Performance? Or hiding traffic from CDN logs?

3. **What are chronicle and spectacle subdomains?**

They have SSL certificates but no DNS records.

4. **Why no GitHub repository?**

Kevin Mitnick published tools post-prison. Transparency = credibility.

5. **Why minified code with no source maps?**

Most legitimate JavaScript security libraries publish source.

**I'm genuinely asking.** If there are legitimate explanations, I'll update this post.

My Answer

**Will I integrate Layer3 Tripwire?**

No.

**Why?**

Because when I analyze security infrastructure, I want to see:

- ✅ Public source code (GitHub repo)

- ✅ Documented architecture (all subdomains explained)

- ✅ Transparent operations (no hidden auth endpoints)

- ✅ CDN logging (all traffic visible)

**What I found instead:**

- ❌ No GitHub repository

- ❌ 3 hidden backend subdomains (discovered via Certificate Transparency)

- ❌ Bearer-authenticated job queue (unexplained)

- ❌ WebSocket bypassing CDN (hiding from logs)

**Legitimate explanation:** Standard SaaS backend architecture (analytics, logging, monitoring)

**Suspicious explanation:** C&C infrastructure for data collection/tasking

**I don't know which it is.** I just know it's there, it's hidden, and it uses the same techniques as the adversaries it claims to detect.

Pattern #21: Infrastructure Transparency Auditing

**New pattern documented.**

When someone sells you security services, audit their infrastructure first:

1. ✅ Check Certificate Transparency logs (crt.sh)

2. ✅ Enumerate all subdomains (public + hidden)

3. ✅ Test hidden endpoints (auth requirements, status codes)

4. ✅ Check for WebSocket usage (C&C patterns)

5. ✅ Look for CDN bypass (hiding from logs)

6. ✅ Search for GitHub repository (source code)

7. ✅ Compare findings to public docs

8. ✅ Document everything (radical transparency)

**Result:** You'll know if their infrastructure matches their marketing.

What Happens Next

**If this analysis is wrong:**

Sergiy (or anyone from Layer3 Intel) can email me: [email protected]

I'll publish your explanation. I'll update this post. Radical transparency cuts both ways.

**If this analysis is right:**

The timing speaks for itself:

- Oct 15-16: Someone scrapes my site (residential proxies)

- Oct 23: I publish threat intel report

- Oct 23 (same day): He emails to sell proxy detection

- Oct 24: I find hidden C&C infrastructure

**Pattern #19 (Honeytrap via Radical Transparency) keeps delivering.**

Evidence Repository

All evidence is public: https://github.com/pduggusa/enterprise-extraction-platform

**Files:**

- `compliance/evidence/threat-intelligence/layer3-tripwire-c2-infrastructure-analysis-oct-24-2025.md` (15,000 words)

- `compliance/evidence/threat-intelligence/layer3-tripwire-dns-investigation-oct-23-2025.md` (10,000 words)

- `compliance/evidence/dugganusa-vs-layer3-infrastructure-comparison.md` (8,000 words)

- `compliance/evidence/threat-intelligence/canada-residential-proxy-scraping-oct-2025.md` (11,000 words)

**Total documentation:** 44,000 words with full receipts.

Reproducible Commands

**All findings are reproducible. Here are the exact commands:**

**Run them yourself. Verify my findings.**

To Readers

**If you're hiring security vendors:**

- Check Certificate Transparency for hidden subdomains

- Test for unexplained auth endpoints

- Look for WebSocket bypass patterns

- Ask for GitHub repositories

- Verify infrastructure matches marketing

**If you're building security services:**

- Document ALL subdomains (even backend ones)

- Don't hide infrastructure from your own CDN

- Publish source code when possible

- Explain authentication endpoints in docs

- Transparency = credibility

**If you're a security researcher:**

- Certificate Transparency is public data

- OSINT is legal (no hacking required)

- Document everything you find

- Publish with epistemic humility (could be wrong)

- Invite corrections (radical transparency)

The Bottom Line

I caught someone scraping my site.

They emailed me to sell proxy detection.

I analyzed their infrastructure.

**Found:** Hidden subdomains, WebSocket bypassing CDN, Bearer-authenticated job queue, no GitHub repo.

**Looks like:** C&C infrastructure for residential proxy operations.

**Could be:** Legitimate SaaS backend architecture.

**I don't know which.** I just documented what I found.

**This is what we do for $0 budget.**

Imagine what we can do with a real one.

**P.S. - If you want to verify I'm not doing the same thing:**

My infrastructure audit is public: `compliance/evidence/dugganusa-vs-layer3-infrastructure-comparison.md`

**Findings:**

- ✅ No hidden auth endpoints

- ✅ No WebSocket usage

- ✅ All subdomains documented (even the one I forgot about)

- ✅ Full source code on GitHub

- ✅ Infrastructure costs published ($77/month)

**We're clean.**

**Update Log:**

- **Oct 24, 2025 00:15 UTC:** Initial publication

- **Awaiting:** Response from Layer3 Intel (if any)

- **Will update:** With any legitimate explanations provided

**Radical transparency = publish findings + publish corrections.**

**Related Posts:**

- [I Caught the Guy Who Attacked Brian Krebs](https://www.dugganusa.com/post/i-caught-the-guy-who-attacked-brian-krebs-he-s-selling-the-solution-now)

- Pattern #19: Honeytrap via Radical Transparency

- Pattern #21: Infrastructure Transparency Auditing (new)

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=1-enumerate-subdomains-via-certificate-transparency