Overview
Domain names are another common IOC type. This lesson covers domains as indicators.
Learning objectives
- Explain domains as IOCs.
- Describe indicators of malicious domains.
- Understand their use and limitations.
Core concept
Domain names are IOCs frequently used to detect malicious activity: known-bad domains (malware command-and-control, phishing sites, malicious downloads) can be matched against DNS and proxy/web logs to find hosts contacting them. Domains are often more durable indicators than IPs (attackers may keep a domain while changing its IP), and certain domain characteristics can be suspicious in themselves — newly-registered domains, algorithmically-generated (DGA-style) random-looking names, or lookalike/typosquatting domains imitating legitimate ones. Like all IOCs, domain matches are leads requiring context and confidence, but domains are a valuable, commonly-used indicator especially for detecting phishing and C2.
How it works
As IOCs, domains are matched against DNS query logs and web/proxy logs: an internal host resolving or connecting to a known-malicious domain is a detection lead (possible malware C2, phishing click, or malicious download). Beyond known-bad lists, analysts watch for suspicious characteristics: newly-registered domains (often used in fresh phishing/malware campaigns), DGA-style random-looking domains (some malware generates many algorithmic domains for C2 resilience), and lookalike/typosquatting domains (mimicking a brand to fool users — tied to phishing). Domains tend to be more durable than IPs (the same domain may persist across IP changes), making them useful for tracking campaigns. Still, a match is a lead weighed by context (is the domain legitimately used?) and confidence. Domain analysis is central to detecting phishing (module 9) and C2 communications, and integrates with DNS knowledge from the networking path.
Practical example
The SOC matches DNS logs against known-malicious domains and finds an internal host querying a known phishing domain — a lead suggesting a user may have clicked a phishing link, prompting investigation of that host and user. Separately, an analyst notices a host resolving a newly-registered, random-looking domain repeatedly at regular intervals — characteristics consistent with malware C2 (DGA-style), warranting deeper analysis even though it wasn't on a known-bad list. Both illustrate domains as IOCs: known-bad matches and suspicious characteristics as detection leads, judged with context.
Cybersecurity relevance
Domains are a valuable, commonly-used IOC — matched against DNS and web/proxy logs to detect hosts contacting malicious infrastructure (C2, phishing, malicious downloads). They're often more durable than IPs (persisting across IP changes), useful for tracking campaigns, and their characteristics (newly-registered, DGA-style, lookalike/typosquatting) can flag suspicion beyond known-bad lists. Domain analysis is central to detecting phishing (module 9) and C2, integrating DNS knowledge from the networking path. Like all IOCs, matches are leads requiring context and confidence. Domains are a core part of IOC analysis and a key indicator for some of the SOC's most common investigations.
Common mistakes
- Only matching known-bad lists, missing suspicious newly-registered/DGA/lookalike domains.
- Ignoring domain context (some flagged domains may be legitimately used).
- Overlooking DNS/web logs as the key data for domain-IOC detection.
Key takeaways
- Domains are common IOCs matched against DNS and web/proxy logs to detect hosts contacting malicious infrastructure (C2, phishing, malicious downloads).
- They're often more durable than IPs and have suspicious characteristics (newly-registered, DGA-style, lookalike/typosquatting) that flag risk beyond known-bad lists.
- Domain analysis is central to phishing and C2 detection; matches are leads weighed by context and confidence — a core part of IOC analysis.
Check your understanding
- How are domains used as IOCs, and against which logs are they matched?
- What domain characteristics can indicate maliciousness beyond known-bad lists?