DomainTools

A global leader for internet #intel that enables security practitioners to proactively defend their organization in a constantly evolving threat landscape.

Public Key

npub182uvw9fpdepyg7zssgjdpsegfh4lj8au4s09v2a0crtxzgj80fwsxala2v

NIP-05 Address

DomainTools@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsr4wx8z5skusjy0pggyfxscv5ym6ler772c8jk9whup4npyfrh5hgpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qzxthwden5te0wfjkccte9eeks6t5vehhycm99ehkueglsj7vu

Publishing to

relay.mostr.pub

relay.shitforce.one

nostr-us.coinfundit.com

Author Public Key

npub182uvw9fpdepyg7zssgjdpsegfh4lj8au4s09v2a0crtxzgj80fwsxala2v

Show more details

Last Notes

2025-06-03 15:07:46

DomainTools is an Exhibiting Sponsor at SLEUTHCON!
Check out our booth later this week at the show. Come for the shirt, stay to learn how domain intelligence can prevent, mitigate, and investigate attacks.
See the full show schedule here: https://www.sleuthcon.com/2025agenda
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/620/055/522/473/584/original/0864fe2ea5d87b0c.jpg

2025-05-29 13:29:06

In 2024, our team found that the web-based version of HeartSender was leaking a significant amount of sensitive data to anyone who accessed it; no login required.
This included customer login details and internal emails from HeartSender staff. Malware infections on the attackers’ own devices revealed extensive account data, along with insights into the group’s structure, operations, and role within the broader cybercrime ecosystem.
Yesterday, Brian Krebs reported that 21 individuals accused of operating Heartsender have been arrested in Pakistan. This milestone was the result of incredible teamwork across borders and organizations, and we're proud to have been part of that global effort.
When we come together, we can give bad actors more bad days.
Find our original analysis and update here: https://www.domaintools.com/resources/blog/the-resurgence-of-the-manipulaters-team-breaking-heartsenders/?utm_source=Mastodon&utm_medium=Social&utm_campaign=Manipulaters

2025-05-28 20:29:18

Pakistani authorities have arrested 21 individuals tied to HeartSender, a long-running phishing and malware-as-a-service operation. The group is linked to global BEC scams and phishing attacks targeting Microsoft 365, iCloud, and more—causing tens of millions in losses.
This takedown highlights the growing international cooperation in cybercrime investigations and the importance of strong digital defenses.
🔗 Read more via @nprofile…5k2y (KrebsOnSecurity): https://krebsonsecurity.com/2025/05/pakistan-arrests-21-in-heartsender-malware-service/
#CyberSecurity #ThreatIntel #BEC #Phishing #Malware #DigitalForensics

2025-04-24 12:56:27

We’re proud to share DomainTools Investigations inaugural domain intelligence year-in-review report.
In the cybersecurity community, it is generally accepted that the threat landscape is fast paced and ever-evolving. It turns out however that there are a few constants that rarely change: Domains and DNS are on top of that list.
In 2024, over 106 million newly observed domains were seen - approximately 289,000 daily.
Report, findings include:
🔹Risk Scoring Detection Techniques: the likelihood of a Domain’s proximity to malware, phishing, spam, etc. to enable prioritization for further investigation and analysis.
🔹Keyword Analysis of Threat Detection: clear patterns of newly created Domain names that included frequently included terms such as “phishing,” “fraud,” “bitcoin,” “scam,” and others.
🔹High Publicity Event Exploitation: large events spurn Domain registration including elections/politics, technological advancements, natural disasters, social movements, and so on.
🔹Commonalities in Malicious Domain Attributes: recurring patterns in preferred registrars, ISPs, nameservers, and SSL issuers used by malicious domains.
🔹Analysis of Newly Registered Top Level Domains (TLDs): analysis to understand how threat actors utilize new TLDs (.lifestyle, .vana, .living, .music - to name a few) in their campaigns.
We want the community to look at this like a blueprint. We are providing analysis on Domain intelligence to enhance our fellow defenders’ ability to identify risky Domains and proactively mitigate threats to help make the Internet a safer place for everyone.
Download the report here: https://www.domaintools.com/dti-inaugural-domain-intelligence-report/?utm_source=Mastodon&utm_medium=Social&utm_campaign=Domain-Intel-Report
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/393/046/842/059/808/original/dd3db11dec561367.png

2025-04-15 13:28:58

🚨 Early Detection of Russian Disinformation Operations
DomainTools Investigations recent research reveals the intricate web of domain registrations powering Russian disinformation campaigns. By analyzing hosting infrastructure and domain clusters, we can identify these threats early on. Dive into the detailed research to understand the tactics used by state-sponsored actors: Domain Registrars Powering Russian Disinformation.
🔍 How to Combat Disinformation: Learn how DomainTools solutions can help you detect and mitigate these threats effectively. From tracking fake news portals to identifying typosquatting and homoglyph attacks, our tools provide comprehensive insights to stay ahead of evolving tactics.
Discover more: https://www.domaintools.com/resources/blog/early-detection-of-russian-disinformation-operations/?utm_source=Mastodon&utm_medium=Social&utm_campaign=Early-Detection-Disinformation
#CyberSecurity #Disinformation #ThreatIntelligence #DomainTools #RussianDisinformation
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/342/214/326/831/349/original/8b839103f566fd9d.jpg

2025-03-24 13:58:26

It's that time again! @nprofile…gqp6 shares his cybersecurity recommendations including podcasts, blog posts, research papers, and more!
He begins with the new podcast: "To Catch a Thief: China's Rise to Cyber Supremacy" from @nprofile…kcsm. Episode one includes @nprofile…3a9e and there are three episodes published to date!
Other recommendations include articles from:
🔹@nprofile…lme0
🔹Veriti
🔹SpyCloud
🔹DataBreachToday
🔹and more!
View the reading list here: https://dti.domaintools.com/cybersecurity-reading-list-week-of-2025-03-24/?utm_source=LinkedIn&utm_medium=Social&utm_campaign=dti-reading-list
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/217/758/710/498/382/original/8b90d744ac322ac7.jpg

2025-03-19 15:16:02

⏰ Our panel discussion on the foundations of DFIR begins in less than 2 hours!
This discussion will cover the PICERL Model (preparation, identification, containment, eradication, recovery, and lessons learned) in reviewing the foundations of a DFIR (Digital Forensics and Incident Response) which are crucial for effectively managing and mitigating cybersecurity incidents, yet they are often forgotten or overlooked.
Panelists include:
▪️ @nprofile…lt74 (DomainTools)
▪️ @nprofile…d2rl (Dragos, Inc.)
▪️ @nprofile…ydkg (Splunk)
▪️ Sarah Sabotka (Proofpoint)
There's still time to register! Save your spot here: https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_source=Mastodon&utm_medium=Social
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/189/752/812/852/225/original/58c9e744866ba587.png

2025-03-19 15:14:14

2025-03-18 15:07:57

📅 Join us tomorrow for a DFIR panel with insights from top experts
How solid do you feel about your organization’s current security practices? If you had an incident, would you feel prepared?
If you feel your security practices could use a tune up, you’re in luck. We’ll have a panel discussion on March 19 focusing on the foundations of Digital Forensics and Incident Response (DFIR) featuring the following industry veterans sharing the basics, sharing war stories, and how to avoid common pitfalls.
The panel includes:
@nprofile…lt74 (CISO and Head of Investigations, DomainTools)
@nprofile…d2rl (Technical Director of Incident Response, @nprofile…h044)
@nprofile…ydkg (Staff Security Strategist, Splunk)
Sarah Sabotka (Senior Threat Researcher, @nprofile…sxvq
We’ll also provide documentation for you to submit for CPE credit approval.
Register here: https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_source=Mastodon&utm_medium=Social&utm_campaign=DFIR-to-You
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/184/057/804/481/590/original/f4f5c2d8d52f2006.png

2025-03-17 18:38:45

DomainTools is excited that @nprofile…lt74 and Austin Northcutt will present at BSidesSF this year!
Be sure to catch: "WHOIS Your Daddy: Tracking Iranian-backed cyber operations with Passive DNS"
As Iran becomes more involved in global conflicts, malicious activity from a threat group they sponsor, MuddyWater, has also increased at scale. View this presentation to learn how passive DNS exposes the mistakes threat groups like MuddyWater make to reveal clear connections between infrastructure, intent, and the states that sponsor these groups.
Find where else you can catch DomainTools here: https://www.domaintools.com/events/rsa-2025/?utm_source=Mastodon&utm_medium=Social
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/179/225/525/348/516/original/a1bdc36ed24ee282.png

2025-03-10 17:45:11

On March 19, @nprofile…ydkg (@Splunk) joins @nprofile…lt74, @nprofile…d2rl, and Sarah Sabotka to discuss the foundations of digital forensics and incident response (DFIR).
This panel discussion will cover the PICERL Model (preparation, identification, containment, eradication, recovery, and lessons learned) in reviewing the foundations of a DFIR (Digital Forensics and Incident Response) which are crucial for effectively managing and mitigating cybersecurity incidents, yet they are often forgotten or overlooked.
If you haven't already, save you spot here: https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_source=Mastodon&utm_medium=Social&utm_campaign=DFIR-To-You
Additionally, DomainTools will provide a document confirming your participation; however, CPE credit approval is not guaranteed. Credentialing organizations, such as ISACA or ISC2, may grant CPE credits for security educational courses if you provide proof of participation.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/139/379/045/888/295/original/92d2b94cc35d5b51.png

2025-03-03 20:01:37

We’re heading back to basics in this upcoming presentation with our panel of experts. We’re all aware that “the threat landscape is changing rapidly,” but how many of us have stopped for a breath to observe if our security practices are built on a solid foundation? If you’re unsure, we can work to change that.
Panelists include:
🔹@nprofile…lt74 (DomainTools)
🔹@nprofile…d2rl (Dragos)
🔹David Bianco (Splunk)
🔹Sarah Sabotka (Proofpoint)
Additionally, we'll provide a document confirming your participation; however, CPE credit approval is not guaranteed. Credentialing organizations, such as ISACA or ISC2, may grant CPE credits for security educational courses if you provide proof of participation.
Save your spot here: https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_source=Mastodon&utm_medium=Social&utm_campaign=DFIR-To-You
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/100/278/335/522/757/original/c114d20b304952a1.png

2025-02-28 17:58:39

📣 @nprofile…lt74 and Kelly Molloy will speak NICAR next Thursday 3/6!
Every online interaction begins with a lookup in the Domain Name System (DNS), the backbone of the Internet. As a result, there are digital footprints left behind in the DNS. With the demise of Whois, investigative reporters are looking for new tools to uncover these footprints. Learn how to use DNSDB Scout, a tool to query DNSDB, a historical passive DNS database, to discover previously unknown online connections and gain new information to advance your ongoing and breaking news investigations.
Basic knowledge of the Domain Name System (DNS) is helpful, but not required. Attendees will need to bring their own laptop (no tablets) to participate in this class.
See the full schedule here: https://schedules.ire.org/nicar-2025/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/808/178/812/169/original/cd44ae7ce1fc2b46.jpg

2025-02-27 14:34:49

Researchers at MITRE have introduced OCCULT, a new standard for managing AI security threats. This innovative approach aims to define and mitigate risks posed by AI systems.
Learn more from SC Media here: https://www.scworld.com/news/researchers-pitch-occult-for-managing-ai-security-threats

2025-02-26 20:50:31

ICYMI: there are several measures that can be taken to lessen the psychological strain suffered by cybersecurity team members during major incidents.
@nprofile…gqp6 stresses the importance of not allowing team members to bottle up their emotions after an incident, as the "keep it to yourself" mentality was a harmful attitude he saw while working as a emergency response dispatcher.
Read the full article by Cynthia Brumfield for CSO Online here: https://www.csoonline.com/article/3829440/managing-the-emotional-toll-cybersecurity-incidents-can-take-on-a-team.html

2025-02-24 17:50:09

@nprofile…d2rl (@nprofile…h044) will join us on March 19 for our Foundations of DFIR panel!
While that's a few weeks away, you can check out Lesley's blog post on The Shifting Landscape of OT Incident Response which illustrates the importance of specialized incident response and digital forensics in maintaining the security and integrity of OT systems.
Find it here: https://www.dragos.com/blog/the-shifting-landscape-of-ot-incident-response/
If you want to catch Lesley along with panelists @nprofile…lt74, David Bianco, and Sarah Sabotka for unique insights on bolstering your DFIR foundations, save your spot here: https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_source=Mastodon&utm_medium=Social&utm_campaign=DFIR-To-You
#DFIR #DigitalForensics #IncidentResponse #Cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/060/124/863/269/892/original/cc35dcb37987947d.png

2025-02-20 18:33:29

Sarah Sabotka (@Proofpoint) will join us on March 19 for our Foundations of DFIR panel!
That's a while away though. Where can you find Sarah before then? Check out this episode of the DISCARDED podcast (Stealth, Scale, and Strategy: Exploring China's Covert Network Tactics - APT41) hosted with Selena Larson and guest Mark Kelly.
By studying APT41's operations, digital forensics and incident response teams can better prepare for and mitigate the impacts of both cybercrime and state-sponsored espionage, ultimately enhancing overall cybersecurity resilience.
Listen here: https://www.proofpoint.com/us/podcasts/discarded
Want to hear more of Sarah's insights, along with conversation with @nprofile…lt74, @nprofile…d2rl, and David Bianco? Join us on March 19 - save your spot here: https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_source=Mastodon&utm_medium=Social&utm_campaign=DFIR-to-You
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/037/646/130/499/055/original/c73bd81468e84ae7.png

2025-02-18 17:12:59

In a recent interview with Jennifer Leggio for @nprofile…kjz2 @hacksforpancakes shares details of cybersecurity threats in operational environments while focusing on improving the human condition.
Find it here: https://www.securityweek.com/rising-tides-lesley-carhart-on-bridging-enterprise-security-and-ot-and-improving-the-human-condition/

2025-02-11 15:10:17

In our upcoming presentation, our panel of experts will take us back to basics. We all know that "the threat landscape is changing rapidly," but have we paused to ensure our security practices are built on a solid foundation? If you're unsure, the answer is likely no. The good news is, we can change that.
Join us as we delve into the PICERL Model (Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned) to review the essential foundations of Digital Forensics and Incident Response (DFIR). These fundamentals are crucial for effectively managing and mitigating cybersecurity incidents, yet they are often forgotten or overlooked.
Our panel includes:
🔹@nprofile…lt74, CISO and Head of Investigations (DomainTools)
🔹@nprofile…d2rl, Technical Director of Incident Response (@nprofile…h044)
🔹@nprofile…ydkg, Staff Security Strategist (@Splunk)
🔹Sarah Sabotka, Senior Threat Researcher (Proofpoint)
📅 Date: March 19
🕒 Time: 10AM PT | 1PM ET
📍 Location: Online
✅ Register here: https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_campaign=&utm_medium=social&utm_source=Mastodon&utm_content=DFIR-To-You
DomainTools will provide a document confirming your participation; however, CPE credit approval is not guaranteed. Credentialing organizations, such as ISACA or ISC2, may grant CPE credits for security educational courses if you provide proof of participation.
#Cybersecurity #DFIR #PICERLModel #BackToBasics #CyberResilience
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/985/885/890/810/090/original/5f7c0b5d3c1fe26b.png

2024-03-14 15:56:02

It’s been a little over a year since many members of the Infosec community moved to Mastodon. In this article, @npub18c7…er9d discusses how the transition has been going and what community looks like on a new social platform. Read more here: https://www.domaintools.com/resources/blog/nowhere-near-extinction-mastodon-one-year-later?utm_source=Social&utm_medium=Mastodon&utm_campaign=nowhere-near-extinction-mastodon-one-year-later
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/094/855/577/229/432/original/a65486904491ce70.jpg