DomainTools

@domaintools.bsky.social

79 Followers 3 Following

A global leader for internet #intel that enables security practitioners to proactively defend their organization in a constantly evolving threat landscape.

Malachi and Ian standing at the DomainTools tabletop
Speaker presenting at a podium with a "Confs Tech" banner on it, at a conference event. The presentation slide behind reads, "Splunk around the Phishmas Tree."
Image displaying a list of internet IP addresses followed by various domain names, including well-known entities like Amazon AWS and SendGrid. These 21 domains are PoisonSeed Domains Registered Since 1 June 2025.
Screenshot of a spreadsheet with columns labeled 'time 1', 'timestamp 1', 'domain 1', and 'appx_domain 1'. Each column lists various entries including times, dates, and website URLs such as ups[.]com, chick-fil-a[.]com, and best-rate[.]site.
Diagram showing web domains and their connections: koala-app[.]com linked to mofa.go[.]kr, webcloud-notice.com linked to spo.go[.]kr, nid-security[.]com linked to dcc.mil[.]kr, and jeder97271@wuzak[.]com linked to wuzak[.]com.
Hands using a smartphone with code and the text "research Saturday" displayed across the screen, reflecting digital research or cybersecurity themes.
Flowchart illustrating a cybersecurity threat involving an Android user. The user is lured to a fake Play Store App website, downloads and installs a 'Dropper APK', which then downloads and installs a secondary APK. This secondary APK connects to a 'C2 Server' via SSL. The process includes icons for Android, APK files, and internet connectivity.
Flowchart illustrating a cybersecurity threat involving an Android user. The user is lured to a fake Play Store App website, downloads and installs a 'Dropper APK', which then downloads and installs a secondary APK. This secondary APK connects to a 'C2 Server' via SSL. The process includes icons for Android, APK files, and internet connectivity.
A screenshot of a PowerShell script showing commands to download and execute a file named "build.exe" from a URL, save it as "svchost.exe" in the TEMP directory, and then run it.