Domain Security: Investigating Domain-Based Attacks

Introduction

What This Guide Covers

Domain intelligence is the practice of using domain registration, DNS, and IP data to identify malicious infrastructure before it reaches your users. This guide covers how security teams apply that data across four chapters, from the registration signals that surface a threat early to the specific workflows analysts run during a live incident.

You will learn how WHOIS and IP records expose the ownership and history behind a domain, how to pivot from a single indicator to the wider infrastructure a threat actor controls, and how newly registered, expired, and dropped domain feeds surface threats while they are still being staged.

The later chapters move from investigation to defense: detecting lookalike and typosquatted domains registered against your brand, what SSL certificate data reveals about an attacker's setup, and the workflows analysts run during a live phishing or domain theft incident.

Each chapter stands on its own. If you already know what a WHOIS record contains and want the applied material, start with Chapter 2.

Why Domain Data Matters in an Investigation

Almost every phishing campaign, malware distribution network, and business email compromise attempt starts with a domain. Someone registers it, points DNS at hosting, and issues a certificate. Each of those steps leaves a record, and those records are what domain intelligence reads. If you have never examined one, run a WHOIS lookup on any domain and read the fields before going further.

That matters because the records exist before the attack does. A lookalike domain registered against your brand is visible at registration, days or weeks before the first email goes out. An analyst who is monitoring registration feeds sees it then. An analyst who is only reading email headers sees it after the first user clicks.

The records also connect. A single malicious domain shares a registrant email, a nameserver, an IP block, or a certificate with others in the same operation. Pivoting on any one of those fields turns one indicator into the full set of infrastructure behind it, which is the difference between blocking one domain and blocking a campaign.

The chapters that follow work through each of those data types in the order an investigation actually uses them. Running these checks by hand works for a single domain. Across a portfolio on a daily schedule, domain monitoring replaces the manual pass with scheduled checks and alerting.

What You Need Before You Start

Nothing in this guide requires a paid account or a security platform. Every check described across the four chapters runs against publicly available records, and the tools that return them are linked at the point each check appears.

What it does require is knowing which record answers which question. Registration records tell you who created a domain and when. DNS records tell you where it points and whether it is live. Certificate records tell you whether someone has prepared it to look legitimate in a browser. Most failed investigations come from reaching for the wrong one, not from lacking access.

A worked example makes the distinction concrete. An employee reports a suspicious invoice email from a supplier domain that looks almost right. Registration data answers whether that domain was created last week or eight years ago. DNS data answers whether it has mail records configured, which separates a domain built to receive replies from one built to serve a phishing page. Certificate data answers whether someone has issued a certificate for it, which is usually the last step before a campaign goes live. Three records, three different questions, and together they resolve in minutes what a mailbox rule cannot resolve at all.