MEDIUM · omc

Indian Oil Corporation

2026-10-05 passive check: HTTP 307; TLS expires 2026-12-12; 2 headers absent on observed response.

iocl.combaseline scan 2026-04-27 · daily passive check 2026-10-05 · historical phase 2 assessment 2026-04-28

Daily passive check · 2026-10-05

score 8

Availability

HTTP 307

TLS

2026-12-12 · 68d

Headers

2 missing · 0 permissive

Email auth

SPF strict · DMARC quarantine

66

Baseline score · 2026-04-27

Watch

Historical findings · 2026-04-27

  • 01admin.iocl.com publicly visible in CT logs
  • 02Sucuri WAF fronts the origin (good)
  • 03CSP loose (upgrade-insecure-requests only)
  • 04Strict SPF (-all), DMARC p=quarantine — solid email auth

TLS security

pass

Issuer
GoDaddy.com
Expires
2026-12-12(68d)

Email authentication

SPF
strict
DKIM
present
DMARC
quarantine

Hardening headers

4 / 0 / 2present/permissive/missing

  • HSTSpresent
  • CSPpresent
  • X-Framepresent
  • X-Content-Typepresent
  • Referrer-Policymissing
  • Permissions-Policymissing

Lookalike domains

  • iocl.net→ 76.223.54.146 (AWS Global Accelerator, third-party)

Public topology · CT logs

13 total · 1 sensitive

iocl.com
Admin
  • admin.iocl.com

Certificate-transparency logs are immutable and public. Sensitive subdomains advertised here cannot be retracted; the mitigation is forward-only — new internal services route through a private CA that does not submit to public CT.

Historical active assessment · 2026-04-28 · open archive

Historical phase 2 assessment · 2026-04-28

This assessment is preserved as a dated record. Its attack paths and patch deadlines are not current findings; use the daily passive check above for current TLS, headers, availability, and email authentication.

Historical question from 2026-04-28

Given the June 2026 TLS rotation window and admin.iocl.com publicly enumerated in CT, what controls prevent DNS hijack or unauthorised CSR submission during renewal — and has the GoDaddy registrar account been audited for compromise?

Active fingerprints · per host

  • iocl.comEOL × 1

    Sucuri WAF + GoDaddy TLS + ASP.NET Core

    • ⚠ Cert rotation in 45 days; Sucuri version not disclosed
  • admin.iocl.comEOL × 1

    cPanel/WHM control panel

    • ⚠ Admin path publicly enumerated in CT logs

Attack-path simulation

Mythos-class adversary analytical chain · paths ranked by exploitability × access value.

#1

Path A: TLS rotation interception + subdomain takeover

effort days
detect low (bad)
Entry
Monitor WHOIS + CT for June 2026 renewal; submit unauthorised CSR or DNS hijack via registrar compromise.
Pivot
Valid TLS cert allows MITM on admin.iocl.com traffic through Sucuri WAF.
Objective
Intercept admin tokens; compromise dealer portal; exfiltrate customer data.
#2

Path B: F5 BIG-IP CVE-2025-53521 (if APM deployed in backend)

effort hours
detect medium
Entry
If F5 BIG-IP APM in stack: pre-auth RCE.
Pivot
RCE on F5 → extract auth tokens → cPanel admin compromise.
Objective
Arbitrary command execution; alter dealer locator; inject malware.
#2

Path D: Email spoofing + executive phishing

effort days
detect low (bad)
Entry
iocl.com SPF tight (-all); admin subdomain may lack SPF.
Pivot
Phishing from admin@iocl.com → CEO → procurement VPN, financials.
Objective
Executive credential theft; lateral move.
#3

Path C: Dealer portal SQL injection via locator.iocl.com

effort days
detect high (good)
Entry
Fuzz /locator/search?location=X for SQLi on unparameterised queries.
Pivot
Extract dealer DB creds, payment data via MSSQL backend.
Objective
Credential harvest from dealer network; supply-chain intel.

Mythos compression

Discovery-time compression: pre-AI adversary vs Mythos-class adversary, per attack path.

Path A · TLS rotation interception + subdomain takeover
factor ~3× if registrar compromised; detection negligible if Let's Encrypt race condition
pre-AI
TLS rotation = known attack window (cf. Triton/TRISIS cert abuse)
Mythos
Pre-registration of attacker domain + DNS hijack during renewal — high-confidence state-level pattern
Path C · Dealer portal SQL injection via locator.iocl.com
factor ~2–5×; Sucuri blocks union-based, misses time-blind
pre-AI
Standard OWASP A1 SQLi on geospatial queries
Mythos
Dealer networks = soft underbelly; SQLi → credential harvest → lateral via dealer workstation (cf. Colonial Pipeline 2021)

The compression factor is reasoned, not measured. Mythos-class capability changes the tempo of attack-path traversal; the topology of the chain is unchanged.

Historical patch list · 2026-04-28

Tier 1 · within 7 days

  • critical

    TLS rotation procedure audit + DNSSEC + CT monitoring

    Host
    iocl.com
    Fix
    Certificate pinning via HPKP. Enable DNSSEC. MFA-only registrar account. CT monitoring (certspotter). Rotate GoDaddy API keys.
    Owner
    Infrastructure / Security
    Validation
    dig +dnssec; CT log monitoring active
  • critical

    F5 BIG-IP CVE-2025-53521 patch (if applicable)

    Host
    iocl.com backend (if F5 APM)
    CVE
    CVE-2025-53521
    Fix
    Upgrade F5 BIG-IP to 17.5.1.3 / 17.1.3 / 16.1.6.1 / 15.1.10.8. CISA KEV deadline 2026-03-30.
    Owner
    Infrastructure / Network Ops
    Validation
    F5 version scan confirms patched
  • critical

    Restrict admin.iocl.com — IP allowlist + 2FA

    Host
    admin.iocl.com
    Fix
    Move admin off public DNS or IP-allowlist on WHM ports 2087/2083. Enforce 2FA. Key-based SSH only. Rotate admin SSH keys.
    Owner
    Infrastructure / SysAdmin
    Validation
    External admin.iocl.com unreachable; 2FA enforced

Tier 2 · within 30 days

  • high

    Dealer locator SQLi remediation

    Host
    locator.iocl.com
    CVE
    CWE-89
    Fix
    Parameterise queries. Allowlist input validation. Sucuri WAF SQLi rules. Rate-limit /locator/search.
    Owner
    Development / QA
    Validation
    sqlmap finds 0 injection points
  • high

    Email spoofing prevention — SPF on admin subdomain + DMARC p=reject

    Host
    iocl.com
    Fix
    Add explicit SPF for admin.iocl.com. DMARC parent policy p=reject. DKIM keys.
    Owner
    Email Security
    Validation
    mxtoolbox SPF/DMARC audit; spoofed mail bounces
  • high

    WordPress plugin security on news.iocl.com / wowstories.iocl.com

    Host
    news.iocl.com / wowstories.iocl.com
    CVE
    CVE-2025-8489
    Fix
    Audit plugins. King Addons → 51.1.35+. Admin-only registration. WAF block on /wp-admin/admin-ajax.php admin payloads.
    Owner
    Content Management
    Validation
    WPScan; registration admin-only

Tier 3 · within 90 days

  • medium

    HTTP security headers verification across iocl.com surface

    Host
    iocl.com
    Fix
    All 6 headers; OWASP ZAP scan; remove server banner.
    Owner
    Development
    Validation
    securityheaders.com returns A+

Methodology is reproducible by any visitor with curl, dig, and openssl. Passive checks record observed HTTP, TLS, header, and DNS state, not proof of exploitation. Historical active assessments are dated and are not current operational guidance.

Sibling: Sanjaya — fuel data on the same Ministry portfolio. Sanjaya tracks energy data; Sanket tracks public security observations.