Domain Tools

Published on: June 25, 2026 Executive Summary Water and wastewater systems have become favored gray-zone targets because they are highly vulnerable and hold disproportionate strategic value. The combination of chronic underinvestment and weak baseline operational technology (OT) security make many of these critical systems easy to compromise. Such intrusions can have both physical and psychological impact, and disruptions often affect civilian life, public health, and trust in government.

What You’ll Learn Adversaries leave a blueprint in DNS long before they launch their campaigns. In this post, we’ll use Formula 1 as a case study to show how to map composite objects and identify threats up to 6 months before they hit blocklists. Using Composite Objects to Beat the Attack Cycle Zooming out to see the entire big picture of the attack cycle and focusing on the composite objects that stick out can be a great way to beat the attack cycle.

Executive Summary Russian intelligence-linked cyber operations continue to emphasize communications-layer collection over disruptive or destructive activity. Recent reporting from U.S. agencies, allied partners, and private researchers highlights two lines of effort. One is the compromise of vulnerable SOHO routers for DNS hijacking and adversary-in-the-middle collection. The other is phishing against secure and commercial messaging platforms.

Published on: June 1, 2026 This report details the analysis of a fully operational Adversary-in-the-Middle (AiTM) credential-harvesting kit targeting Microsoft 365 and Entra ID identities. The attack involves a three-to-five stage funnel starting from financial, recruiting, and document related domain name themes. The funnels typically begin with an anti-analysis CAPTCHA gate to filter sandboxes.

Published on: May 19, 2026 Executive Summary ZionSiphon is a malware sample (“SCADA_SecurityPatch_v8.4.exe”) that has been circulating in public sandboxes since 2025. It is best understood as a Windows-based implant with explicit industrial control system (ICS) targeting intent but with a critical limitation in its verification of geographic data that fundamentally constrains its operational viability.

Skip to main content Published on: May 19, 2026 One domain can tell you a lot about the intent, connections, and context behind a potential threat. But the one domain you are seeing could be connected–through the same IP address–to hundreds or more domains that you’re not seeing, hosted on the same infrastructure. Now, imagine having a data feed of all active, high-risk hosting IP addresses, as well as the enrichment data behind them, updated and delivered in real-time into your security stack.

Executive Summary The Doppelgänger (aka Social Design Agency (SDA)) campaigns are a coordinated series of online influence operations attributed to Russian-linked actors and associated with the technical operator, Structura. The campaign leverages a distributed ecosystem of spoofed media websites, Telegram amplification networks, and coordinated X/Twitter bot account clusters to disseminate political narratives targeting Western audiences.

Published on: May 7, 2026 Who doesn’t love a good “The Sound of Music” reference! But did you know that there is a completely different movie based on the same subject matter that was filmed in Germany in 1956, a whole nine years before The Sound of Music? It’s called “Die Trapp-Familie” (or “The Trapp Family”).

US Public Sector Defend national security, protect the warfighter, and stay ahead of adversaries. DomainTools shows federal, defense, and intelligence teams who owns a domain, where it's hosted, what it's connected to, and how risky it is, exposing adversary infrastructure before it reaches the network.

Executive Summary The DPRK “Contagious Interview” campaign (LAZARUS) represents a mature evolution of intrusion tradecraft in which adversaries weaponize legitimate hiring workflows to induce execution of malicious code within trusted developer environments.