🎯 Origin-IP-Hunting

async def score_origin_candidates(domain: str, vectors: list[VectorResult]) -> list[OriginCandidate]: scores: dict[str, float] = defaultdict(float) sources: dict[str, list[str]] = defaultdict(list) for vector in vectors: for ip, weight in vector.candidates: if not _is_cdn_ip(ip): # CDN-eigene IPs ausfiltern scores[ip] += weight sources[ip].append(vector.name) candidates = [] for ip, raw_score in scores.items(): confidence = min(raw_score, 1.0) # Cap auf 1.0 # Bonus: TLS-Zertifikat enthält Hostname-Match if _cert_matches_domain(ip, domain): confidence = min(confidence + 0.15, 1.0) candidates.append(OriginCandidate( ip=ip, confidence=confidence, sources=sources[ip], asn=_lookup_asn(ip), bypass_verified=False, # Erst nach aktivem Verify )) return sorted(candidates, key=lambda c: c.confidence, reverse=True)

async def verify_bypass(candidate: OriginCandidate, domain: str) -> BypassResult: cdn_response = await _fetch_via_cdn(domain) # Direkter Request an Origin-IP mit Host-Header-Spoofing direct_response = await _fetch_direct( ip=candidate.ip, host_header=domain, timeout=10, verify_tls=False, # Self-signed cert auf Origin erwartet ) similarity = _compare_responses(cdn_response, direct_response) return BypassResult( ip=candidate.ip, bypass_confirmed=similarity >= 0.85, confidence=1.0 if similarity >= 0.85 else candidate.confidence, cdn_status=cdn_response.status, direct_status=direct_response.status, body_similarity=similarity, waf_bypassed=direct_response.status == cdn_response.status and similarity >= 0.85, )