import "hash"

rule bulwark_https_bulwarkblack_com_ai_infrastructure_control_plane_attack_surface
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/ai-infrastructure-control-plane-attack-surface/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:22:53Z"
        tlp = "TLP:CLEAR"
        indicator_count = "19"
    strings:
        $s0 = "45.150.109.151.sslip.io" ascii wide nocase  // Domains
        $s1 = "auto.c3pool.org" ascii wide nocase  // Domains
        $s2 = "c3pool.org" ascii wide nocase  // Domains
        $s3 = "gobygo.net" ascii wide nocase  // Domains
        $s4 = "horizon3.ai" ascii wide nocase  // Domains
        $s5 = "oast.fun" ascii wide nocase  // Domains
        $s6 = "oast.me" ascii wide nocase  // Domains
        $s7 = "oast.pro" ascii wide nocase  // Domains
        $s8 = "sslip.io" ascii wide nocase  // Domains
        $s9 = "yosemite.jp" ascii wide nocase  // Domains
        $s10 = "135.125.10.56" ascii wide nocase  // IPv4
        $s11 = "172.232.38.92" ascii wide nocase  // IPv4
        $s12 = "194.213.18.133" ascii wide nocase  // IPv4
        $s13 = "45.150.109.151" ascii wide nocase  // IPv4
        $s14 = "47.86.197.116" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "3af9f25a4d45bb4f1ec5627cdbc6703cf3b4be75a892162d299d80ddfb266f42" or
        hash.sha256(0, filesize) == "3d24ac736635e0fa0c5c459c9e18ca09d1ec9a1751a4503130934395609bd7e0" or
        hash.sha256(0, filesize) == "49fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8f" or
        hash.sha256(0, filesize) == "f64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc"
}