Show in Graph
Common Information
Type Value
Value 
Domains - T1583.001
Category Attack-Pattern
Type Mitre-Attack-Pattern
Misp Type Cluster
Description Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing) Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique) Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering) Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1)
Details Published Attributes CTI Title
Details Website 2035-08-05 23 Inside Jahoo (Otlard.A ?) - A spam Botnet
Details Website 2025-12-17 17 Stories from the SOC: Caught in the Trap: Detecting and…
Details Website 2025-11-07 1 Vault7 - Home
Details Website 2025-09-05 0 New LevelBlue Threat Trends Report gives critical insights…
Details Website 2025-09-01 0 How ThreatConnect and Polarity Empower Teams to Combat Phishing Threats | ThreatConnect
Details Website 2025-08-06 0 Preparing Evidence for a Validated HITRUST Assessment
Details Website 2025-07-05 20 Online Services Again Abused to Exfiltrate Data - SANS Internet Storm Center
Details Website 2025-05-24 0 FTC finalizes order requiring GoDaddy to secure hosting services - PRSOL:CC
Details Website 2025-05-24 1 Microsoft Seizes Domains Linked to Ransomware in Cyber Dragnet - Bloomberg.com | #ransomware | #cybercrime - National Cyber Security Consulting
Details Website 2025-05-24 5 Cobalt Strike Beacon Detected - 123[.]207[.]66[.]232:8081 - RedPacket Security
Details Website 2025-05-24 6 Cobalt Strike Beacon Detected - 5[.]58[.]172[.]98:8080 - RedPacket Security
Details Website 2025-05-24 0 184 Million Users' Passwords Exposed From an Open Directory Controlled by Hackers | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware - National Cyber Security Consulting
Details Website 2025-05-24 351 Индикаторы компрометации ботнета Mirai (обновление за 24.05.2025)
Details Website 2025-05-24 2 Top 10 Daily Cybercrime Brief by FCRF [24.05.2025]: Click here to Know More | #cybercrime | #infosec - National Cyber Security Consulting
Details Website 2025-05-24 12 Крах империи Danabot: как был обезврежен опасный инфостилер
Details Website 2025-05-24 7 Новый вредонос Chihuahua Stealer атакует пользователей через облачные сервисы
Details Website 2025-05-24 0 Ransomware Kill Chain Whacked As FBI, Secret Service And Europol Attack | #ransomware | #cybercrime - National Cyber Security Consulting
Details Website 2025-05-24 0 $24M in crypto, 30 Bitcoins, and $700K seized as FBI takes down Russian hacker behind 700,000 computer ransomware army in Operation Endgame | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware - National Cyber Security Consulting
Details Website 2025-05-24 0 300+ Servers Taken Down In Global Cybercrime Crackdown | #cybercrime | #infosec - National Cyber Security Consulting
Details Website 2025-05-24 0 Operation Endgame claims 300 domains in mass takedown effort
Details Website 2025-05-23 1 Operation Endgame claims 300 domains in mass takedown effort | #cybercrime | #infosec - National Cyber Security Consulting
Details Website 2025-05-23 0 16 Charged in DanaBot Malware Case, $50M in Damages | #cybercrime | #infosec - National Cyber Security Consulting
Details Website 2025-05-23 0 Ransomware hackers charged, infrastructure dismantled in international law enforcement operation | #ransomware | #cybercrime - National Cyber Security Consulting
Details Website 2025-05-23 49 Katz Stealer Threat Analysis - Nextron Systems
Details Website 2025-05-23 0 [STORMOUS] - Ransomware Victim: French Gov 2025 - RedPacket Security