“Behavior reflects personality. The best indicator of future violence is past violence. To understand the “artist,” you must study his “art.” The crime must be evaluated in its totality. There is no substitute for experience, and if you want to understand the criminal mind, you must go directly to the source and learn to decipher what he tells you. And, above all: Why + How = Who.”
― John E. Douglas, Mindhunter: Inside the FBI’s Elite Serial Crime Unit
The above quote is also applicable when you deal with cybercrime investigations. Though registrars usually do not deal with serial killers, we do deal with a lot of security threats.
And security threats require a holistic approach to get to the Why + How = Who.
Lucky for cyber threat intelligence analysts, there is Spiderfoot created by Steve Micallef. Spiderfoot automates a lot of research and combines the data.
So let me run you through a typical abuse report and how I used to approach such a report.
Assume the domain name account-login.tld is reported for malware activities. The experienced investigator understands that such a domain name can be used for a lot of different things.
- apple.com.account-login.icu
- BankName.account-login.tld
- YourCompany.URLaccount-login.tld
With just a few of the above examples, the potential scope of criminal possibilities has expanded from malware to spam to phishing and or account theft. BEC/VEC fraud is also associated with such domain names.
I also could be dealing with a poorly chosen domain name of a company that uses the domain name to let employees log in to a CRM. Here at Realtime Register, we also have a few domain names that, at first glance, reveal nothing about our business but are essential in our daily operations. Suspending such domain names even if there is a report of malware could be very tricky.
Not to mention the legal liabilities.
If the domain name is suspended and hundreds of employees cannot do their work, well, again tricky.
So what I lack here is actionable info.
The first action is to inform the reseller of the security threat report. Making sure the uptime is as low as possible is essential. The reseller might be dealing with an unmanaged VPS, which also complicates the matter.
I mention the unmanaged VPS with a reason. Often wholesale registrars are powerless to address the issue.
Wholesale registrars might not host anything or do not provide email services. But with some research, things might become actionable.
Weapons of choice.
So there are many tools out there that you can use for your investigation.
Virustotal.com can be used for a second opinion when dealing with malware or phishing. It has many more features, so check it out.
Do you want to check if subdomains are present for malicious practices? Well, try Sublist3r.
If you want to check co-hosted sites, DGA domains, or cybersquatting domain names on a server, check out RiskIQ community edition.
RiskIQ is also great for some first OSINT research and is just awesome when doing reverse domain name lookups through a Google or FB id.
You also want to check some threat exchanges like Pulsedive. Getting some info on past breaches and leak sites is also handy to known.
Doing a little research on the dark web through Intelligence X on the domain name could reveal actionable info also.
The need for speed
Checking all the mentioned sources would take a lot of time, most likely a full day to gather the information.
Not to mention, you need to analyze all the information.
So here is where Spiderfoot comes in.
Spiderfoot connects to all these databases and pulls that info for you.
One interface, one scan, and within 30 minutes, you usually have actionable information.
Through the report section, you correlate the data and collected evidence.
The evidence can be exported, which is a great plus if an officer of the law contacts you about a malicious domain name.
Usually, LE’s officers are somewhat surprised by the amount of data you have on a target.
Reconnaissance, the first scan
The scan setting I use is always set to passive, and there are a few reasons for that.
-I do not want to alert the criminals that they are being investigated.
-The scan is a lot quicker, and it gives me enough results to understand the threat level.
-As I am not sure about what kind of technical infrastructure I am dealing with, I like to make sure I do not break something by accident. Having a reseller go berzerk on you is something you want to avoid for many good reasons.
By now, I have confirmation that either passing the security threat report to the reseller was enough.
Or I need to suspend the domain name?
I also might have evidence now that I am dealing with a criminal reseller.
Or criminals are abusing the services of our resellers. Either way, I need to act.
What action is required depends on many factors. In the past, we dealt with criminal resellers who registered a bunch of sleeper domain names.
Usually, it is best to take all those domain names offline before they become active. But again, there might be a situation where this is not the best course of action. For example, you do not want to alert the criminal just yet.
Or there is conflicting info that requires more investigation focus.
Versions of Spiderfoot.
There are several versions out there of Spiderfoot. My advice if you are going to use Spiderfoot go for the HX, aka cloud version. Visit the website here.
- You have a centralized solution and reports for you and your team members in one place
- Always the latest version
- Instant access to new modules
- No need to tinker around with Linux or Python
Overkill?
The above use of OSINT techniques and the use of Spiderfoot as part of a set procedure when dealing with domain names that are engaged in abuse might seem like overkill.
But too often, the reality is that we quickly detect patterns and can avoid future security threats and prevent fraud for our customers.
Usually, these fraudulent domain names are registered with stolen credit cards or stolen Paypal accounts.
As you can imagine, there is a monetary loss, not to mention there is paperwork involved.
No reports.
I want to highlight the fact that a lot of abuse goes unreported.
My first thought that the correct parties were contacted by skipping the registrar.
But often, I had to hear back that a hosting company wasn’t informed about the security threat.
Where the disconnect is located is unknown to me at this moment.
But perhaps the issue of the disconnect could be a discussion item for ICANN 66, as it appears there is a lot of low hanging fruit.
For more information about Spiderfoot, check the website.
A word of advice for my registrar/registry colleagues.
While Spiderfoot automates a lot of tasks for you, it does not substitute experience.
Experience in cyber threat intelligence is required in your decision making. Again Why + How = Who.
.