Something’s Phishy: See the Hook Before the Bait
summary
Claims a method to find DNS artifacts and adversary infrastructure as they are created to map intent before weaponization, using passive DNS and historical WHOIS to pivot from a single domain to connected infrastructure. Demonstrates a 3D scatter plot of registrar/name‑server/ISP convergence, automated queries with SpiderFoot and SIEM rules in Splunk/Cortex, and examples like instagramup-support-e.com and trustwalletup-support.com. Reports 6,000 new domains registered with roughly a tenth malicious and shows early detection (zero on blocklists) reduces dwell time.
AI-written summary · about
chapters (10)
- 0:00Introduction and setup
- 3:50DNS as critical threat signal
- 7:02DNS primer and forensic gold
- 11:57Passive DNS for deeper analysis
- 15:27Malicious infrastructure patterns
- 19:20Proactive campaign detection
- 22:08Real-world malicious domain examples
- 25:42Automating DNS threat hunting
- 27:50Recap and call to action
- 29:15Q&A session
related talks
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
47mDNS On Fire
59mCatching Malware En Masse: DNS and IP Style
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
28mFerris Bueller's Guide to Abuse Domain Permutations
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
27mCatching the Phisherman
48mDawn Of The Dead: The Tale Of The Resurrected Domains