Sign in

DomainTools

@domaintools.bsky.social
87 followers 3 following 123 posts

A global leader for internet #intel that enables security practitioners to proactively defend their organization in a constantly evolving threat landscape.

PostsRepliesMedia
DomainTools @domaintools.bsky.social · 20/08/2026
DomainTools will be exhibiting at the Intel Summit next week. Stop by Kiosk 24 to say hello and see the latest ways we're supporting the IC in identifying risks, investigating threats, and staying ahead of evolving adversaries! #intelsummit
010
DomainTools @domaintools.bsky.social · 05/06/2026
The DomainTools team is at SLEUTHCON! Stop by our booth to say hi and grab a "Zero Day" t-shirt, (and no, we won't pitch our product before you can get a shirt) ! #Cybersecurity #SLEUTHCON #InfoSec #Cybercrime
120
DomainTools @domaintools.bsky.social · 02/06/2026
This Friday, we'll be at #SLEUTHCON ! Stop by our booth to say hi and enter our raffle to win a Nintendo Switch 2: Choose Your Own Game Bundle! #SLEUTHCON2026 #Cybersecurity #Infosec
010
DomainTools @domaintools.bsky.social · 19/05/2026
Announcing our IP risk and IP hotlist are now available in real-time feeds, giving you access to all IP addresses to show the most dangerous and currently active infrastructure. Learn more: www.domaintools.com/blog/increase-t…
000
DomainTools @domaintools.bsky.social · 30/04/2026
Join our webinar: Supercharging the SOC with DomainTools MCP to learn how to supercharge your workflow using DomainTools MCP. 🗓️May 07, 2026 🕜 10:00 AM PT/1:00 PM ET 🔗www.domaintools.com/webinars/supercharging-the-soc-with-domaintools-mcp?utm_campaign=mcpwebinar&utm_medium=social&utm_source=twitter
000
DomainTools @domaintools.bsky.social · 28/04/2026
ICYMI: IrisQL, our new query language, makes it easier than ever to share logic across teams and ticketing systems. Explore how to optimize your security stack here: www.domaintools.com/blog/supercharg… #ThreatHunting #IrisQL #Infosec #DataScience
000
DomainTools @domaintools.bsky.social · 09/04/2026
Access DomainTools via the Model Context Protocol (MCP) 🌐 Connect your LLM or MCP enabled platform directly to our data to: ✅ Automate data retrieval and analysis ✅ Reduce context-switching ✅ Investigate at the speed of AI Click here to learn more (www.domaintools.ai/mcp-access.
000
DomainTools @domaintools.bsky.social · 02/04/2026
Our MCP server brings DomainTools to your LLM. Investigation flow: 1️⃣ Prompt: “Look up [domain].” 2️⃣AI: Returns Risk Score & profile including IP 3️⃣Deep Dive: “What other domains are linked to this IP?” 4️⃣Result: Instant infrastructure map. Request a demo now: www.domaintools.ai/mcp-access
000
DomainTools @domaintools.bsky.social · 31/03/2026
We’re thrilled to announce our new MCP server, enabling you to access DomainTools intelligence directly within your AI workflows. Learn more today: www.domaintools.com/press/domaintoo…
000
DomainTools @domaintools.bsky.social · 24/03/2026
Planning your #FIC2026 schedule? Stop by the DomainTools booth # G49 for a live demo and a quick conversation with our team. We’re happy to meet over a coffee ☕nearby – or connect virtually if you can’t make it.
000
DomainTools @domaintools.bsky.social · 23/03/2026
The DomainTools team is at #RSAC2026 holding meetings at Spaces. In case you missed it, you can still schedule a meeting with us at the link here: www.domaintools.com/events/rsac-2026
000
DomainTools @domaintools.bsky.social · 11/02/2026
🪷 The Petals of Espionage: DomainTools Investigations’ latest research analyzes the “who”, “how”, and “why” behind Lotus Blossom’s compromise of Notepad++. Read the investigation: dti.domaintools.com/research/lotus-…
010
DomainTools @domaintools.bsky.social · 11/02/2026
It’s Day # 2 of #AFCEAWest, and DomainTools Federal is here at the San Diego Convention Center. Stop by Booth # 2309 to talk to our team about how we give you the offensive edge against state sponsored adversaries. #CyberDefense #ThreatHunting #Federal #DomainTools
000
DomainTools @domaintools.bsky.social · 28/10/2025
From NPM bypasses to crypto scam networks—October brought a wave of complexity, and we’ve got the full analysis. Read and subscribe to October’s edition of the DomainTools Investigations Newsletter here: www.linkedin.com/newsletters/dt-inv…
000
DomainTools @domaintools.bsky.social · 11/10/2025
Thanks to all that attended Ian Campbell and @mjwalk.bsky.social #BSidesNoVA talks this morning. Please don’t hesitate to stop by our table and say hello 👋 !
000
DomainTools @domaintools.bsky.social · 11/10/2025
At 11:30 AM Ian is presenting on DNS and domain intelligence as it applies to investigative journalist investigations. In related news, Allan Liska is selling “The Press Guardian”. We highly recommend checking out his table as well! bsidesnova-2025.sessionize.com/session/1001...
000
DomainTools @domaintools.bsky.social · 11/10/2025
Attending #BSidesNoVA? Be sure to say hello to Malachi and Ian at the DomainTools table before their talks at 11:30!
Malachi and Ian standing at the DomainTools tabletop
000
DomainTools @domaintools.bsky.social · 10/09/2025
Steve Behm at #splunkconf25 shared a 2-year investigation into attacks on USPS & Amazon. His talk highlighted how to use Splunk and DomainTools to detect DGA domains and automate domain discovery. #Cybersecurity #ThreatIntelligence #Splunk #Phishing
Speaker presenting at a podium with a "Confs Tech" banner on it, at a conference event. The presentation slide behind reads, "Splunk around the Phishmas Tree."
000
DomainTools @domaintools.bsky.social · 10/09/2025
New research raises questions about PoisonSeed using TTPs similar to SCATTERED SPIDER. The DTI team identified 21 new malicious domains spoofing SendGrid and using fake Cloudflare CAPTCHAs to harvest credentials: bit.ly/46w63on #ThreatIntel #PoisonSeed #SCATTEREDSPIDER
Image displaying a list of internet IP addresses followed by various domain names, including well-known entities like Amazon AWS and SendGrid. These 21 domains are PoisonSeed Domains Registered Since 1 June 2025.
000
DomainTools @domaintools.bsky.social · 08/09/2025
With our new Feed API, security teams can get near-real-time domain intelligence to prevent & respond to threats faster. Learn how to integrate the Newly Observed Domains feed into Splunk for use cases like proactive threat blocking & brand protection: bit.ly/4lZwFCE
Screenshot of a spreadsheet with columns labeled 'time 1', 'timestamp 1', 'domain 1', and 'appx_domain 1'. Each column lists various entries including times, dates, and website URLs such as ups[.]com, chick-fil-a[.]com, and best-rate[.]site.
000
DomainTools @domaintools.bsky.social · 05/09/2025
The "Kim" leak exposes a DPRK APT expanding operations into Taiwan & targeting identity systems. Our analysis provides IOCs & defensive guidance for analysts & SOC teams: dti.domaintools.com/inside-the-kims…
Diagram showing web domains and their connections: koala-app[.]com linked to mofa.go[.]kr, webcloud-notice.com linked to spo.go[.]kr, nid-security[.]com linked to dcc.mil[.]kr, and jeder97271@wuzak[.]com linked to wuzak[.]com.
000
DomainTools @domaintools.bsky.social · 25/08/2025
Thank you, Dr. Renée Burton, for your incredible work making the digital world safer! As VP of infoblox.bsky.social Threat Intel, she & her team exposed VexTrio, a massive global ad fraud and scam operation Learn more: thecyberwire.com/podcasts/research-…
Hands using a smartphone with code and the text "research Saturday" displayed across the screen, reflecting digital research or cybersecurity themes.
000
DomainTools @domaintools.bsky.social · 25/08/2025
A new #SpyNote report is out! 🚨 Dive into the tactics of this Android RAT campaign, from dynamic payload decryption to new obfuscation methods. Learn how threat actors are using deceptive Google Play Store clones to target users dti.domaintools.com/spynote-malware…
Flowchart illustrating a cybersecurity threat involving an Android user. The user is lured to a fake Play Store App website, downloads and installs a 'Dropper APK', which then downloads and installs a secondary APK. This secondary APK connects to a 'C2 Server' via SSL. The process includes icons for Android, APK files, and internet connectivity.
000
DomainTools @domaintools.bsky.social · 22/08/2025
A new #SpyNote report is out! 🚨 Dive into the tactics of this Android RAT campaign, from dynamic payload decryption to new obfuscation methods. Learn how threat actors are using deceptive Google Play Store clones to target users dti.domaintools.com/spynote-malware…
Flowchart illustrating a cybersecurity threat involving an Android user. The user is lured to a fake Play Store App website, downloads and installs a 'Dropper APK', which then downloads and installs a secondary APK. This secondary APK connects to a 'C2 Server' via SSL. The process includes icons for Android, APK files, and internet connectivity.
010
DomainTools @domaintools.bsky.social · 22/08/2025
Recent DTI research tracked a trojan using hosted PowerShell scripts, uncovering bulletproof hosting services and how #LummaStealer remains a threat. Read the full report: dti.domaintools.com/hunting-for-mal… #Cybersecurity #ThreatIntel #Malware #BlueTeam
A screenshot of a PowerShell script showing commands to download and execute a file named "build.exe" from a URL, save it as "svchost.exe" in the TEMP directory, and then run it.
020