Suspicious Domain Investigation Guide

Goal

Determine whether a domain is malicious, benign, or suspicious-but-unproven — against evidence, without fabrication.

Prerequisites

• The suspect domain; passive DNS/reputation sources; threat-intelligence correlation.

Evidence collection

• Registration: WHOIS age, registrar, registrant privacy — ultra-recent registration coupled with lookalike spelling is a phishing/C2 signal.
• DNS: A/AAAA, NS, MX, TXT (SPF/DKIM/DMARC) via guides:tool-dns-guide and guides:analyze-dns. Fast-flux NS or rotation suggests C2 (T1071).
• Reputation: check the domain/IP against IOC data (guides:tool-ioc-guide), lookalike-of a reputable brand, and url scan (guides:tool-url-analyzer-guide).

Indicators

• Recent auto-renew registration, uncommon TLD, typosquatted name, dangling DNS, or resolved IP with bad reputation.

Validation

• Correlate ≥2 indicators (e.g., young registration + reputation hit) before calling it malicious; a single weak signal stays “uncertain”.

Investigation

• Pivot domain → IP → other domains on the same IP/nameserver → email indicators (see security:email-security) → any linked campaign.

Decision

• Block/hunt if threat correlation is strong; monitor if uncertain; no action if no signal.

Containment & mitigation

• Add deny rules at filter/DNS for confirmed malicious domains; ticket to phishing response (guides:phishing-email-investigation-playbook).

References

• MITRE T1566 / T1071; ICANN WHOIS as listed.