Papino12/sa-vps-exposure-cti-assessment

Cyber Threat Intelligence (CTI) portfolio report analysing South African VPS exposure risks using passive OSINT methods, including Shodan, IPinfo, VirusTotal, MITRE ATT&CK mapping, vulnerability analysis, and responsible disclosure practices. # SA VPS Exposure CTI Assessment ## External Cyber Threat Intelligence Risk Assessment **Analyst:** Neo ML **Role:** Cyber Threat Intelligence Analyst (Portfolio Project) **Assessment Date:** 17 April 2026 **Report Type:** External Risk Assessment **Classification:** Public Portfolio Version (Redacted) --- # Project Overview This repository contains a Cyber Threat Intelligence (CTI) assessment analysing an externally exposed South African VPS environment. The objective of this assessment was to demonstrate a professional CTI workflow using publicly available intelligence sources to identify: - Internet-facing services - Potential attack surface - Vulnerability exposure - Threat intelligence indicators - Security risks - Recommended remediation actions All information has been redacted before publication to protect privacy and follow responsible disclosure practices. --- # Assessment Scope ## Environment Assessed **Target Type:** South African VPS / Cloud Hosting Infrastructure **Assessment Approach:** Passive OSINT (Open Source Intelligence) **No active testing performed.** This assessment did not include: - Exploitation - Authentication attempts - Password attacks - Vulnerability scanning - System access The assessment was limited to publicly available information. --- # Tools Used ## Intelligence Collection ### Shodan Used for: - Internet-facing service discovery - Open port identification - Banner information - Vulnerability tags --- ### IPinfo Used for: - IP enrichment - Geographic information - ASN information - Hosting provider context --- ### VirusTotal Used for: - Reputation checking - Malware intelligence review - Security vendor analysis --- ### abuse.ch ThreatFox Used for: - Threat intelligence checking - Abuse indicator review --- # Frameworks Used ## MITRE ATT&CK Techniques referenced: | Technique | Description | |---|---| | T1133 | External Remote Services | | T1190 | Exploit Public-Facing Application | | T1110 …