AiTM API (Beta) Documentation

/list

Info

Provides a JSON list of AiTM infrastructure from the last 7 days as well as some rich information about it.

Example Request

You can query this endpoint with either a GET/POST request. An example curl command is as follows:

curl

curl -H "Authorization: Bearer <YOUR_API_KEY>" https://aitm-beta.lab539.dev/list

Powershell

Invoke-RestMethod -Uri "https://aitm-beta.lab539.dev/list" -Method Get -Headers @{Authorization = 'Bearer <YOUR_API_KEY>'}

Example Response

If successful this will return a response which will include a number of JSON records, one for each entry. Below is a snippet from a real response:

If you want the response as a list of JSON objects rather than an array then add the ?format=list parameter to your request.

The objects and their types are:

• hostname : string

• domain : string

• ip : string

• rdns : string

• asn : string

• frontend : bool

• backend : bool

• active : bool

• timestamp : int

• confidence : string

• country : string

• eventid : string

You should expect duplication of some object data in your feed, so please ensure that you handle that sensibly - the only unique field should be the eventID but it is entirely possible to get identical events with only the time and eventID field differing. We do not remove events from the feed and the feed only includes records from the last 7 days.

Frontend, Backend, Active

There are three boolean values in the results:

• frontend - this is set to “true” if the infrastructure in the record is operating as frontend infrastructure - i.e. it is infrastructure to which users are likely to authenticate, typically this is infrastructure hosting phishing websites or content. We recommend restricting access to this infrastructure (e.g. blocking at proxies or DNS)

• backend - this is set to “true” if the infrastructure in the record is operating as backend infrastructure - i.e. it is infrastructure from which you are likely to see AiTM proxied authentication attempts. We recommend blocking authentication attempts from AiTM backend infrastructure

In a lot of cases there is overlap and some infrastructure may operate both backend and frontend functions, so both flags may be set to true. The dataset we are providing in the beta will mostly fall into this category.

• active - this is set to “true” if the infrastructure appears to be active (i.e. alive) at the point we identify it (of course it may go offline at any point). We have mechanisms that allow us to identify offline infrastructure but this data is not being provided in the beta data feed. Offline infrastructure would have its active flag set to false.

Confidence Levels

• confidence - rather than a score we decided to set the confidence level to one of “high”, “medium” or “low”. This is to help you decide whether certain actions are appropriate or not. You may chose to be more robust with your actions for high confidence infrastructure than you would be for low confidence infrastructure.

We should highlight that this confidence level relates to our confidence this being AiTM infrastructure - we make no assessment as to whether this AiTM infrastructure is being used for nefarious purposes. You will likely see some infrastructure that is clearly part of educational phishing related campaigns as you will also see infrastructure which is clearly involved in concerning activities.