WHOIS Your Daddy: Tracking Iranian-backed Cyber Operations Through Infrastructure

WHOIS Your Daddy: Tracking Iranian-backed Cyber Operations Through Infrastructure

Speaker: Austin Northcutt

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=-agd3rnHl6I

Reading time: ~7 minutes

TL;DR

Starting from just four malicious domains attributed to Iranian state-sponsored threat actor MuddyWater, DomainTools solutions engineer Austin Northcutt used passive DNS pivoting and name server analysis to expand the initial indicator set to over 2,500 domains. The talk demonstrates how threat actors leave consistent infrastructure "fingerprints" that researchers can exploit to uncover entire malicious networks from a single unique data point.

Introduction

Nation-state cyber operations run on infrastructure, and infrastructure leaves traces. For defenders, the challenge is knowing where to look and how to pivot from a handful of known-bad indicators to a rich, actionable picture of a threat actor's operational footprint. At BSidesSF 2025, Austin Northcutt of DomainTools showed how methodical DNS intelligence work — anchored by a single peculiar name server domain — turned a modest open-source threat report into a trove of over 2,500 suspect domains linked to MuddyWater, an Iranian Ministry of Intelligence cyber espionage group.

The approach is as much tradecraft as technology: understanding how threat actors "tie their shoes" — the habitual patterns they repeat when building malicious infrastructure — and then following those patterns wherever they lead. The result is a masterclass in passive DNS research that any threat intelligence practitioner can replicate.

The Starting Point: MuddyWater and BugSleep

▶ Watch: Background on MuddyWater and BugSleep (02:00)

The research began with a Check Point Research report on BugSleep, a previously undocumented malware variant attributed to MuddyWater (also tracked as Static Kitten and, with some vendor creativity, "Day Old Pizza"). MuddyWater is a state-sponsored threat actor conducting cyber espionage on behalf of Iran's Ministry of Intelligence (MOIS) — the Iranian equivalent of Russia's FSB or China's MSS. The group primarily targets government agencies and private entities in the Middle East, with activity surging significantly after the start of the Israel-Hamas conflict.

The Check Point report identified five IOCs, all domain-based. Four of the five were malicious C2 servers; the fifth was Ignite, a legitimate file transfer service being abused for malware delivery — a well-worn tactic also seen with Dropbox and Google Drive. The four malicious domains shared a distinctive naming pattern: two to three technology-themed terms concatenated together (e.g., "smart cloud company," "software host"). Generic enough to avoid impersonating a specific brand, but consistent enough to constitute a signature.

Enter HostorDaddy: The Suspicious Name Server

▶ Watch: Discovering the HostorDaddy name server (06:00)

Examining the domain registration data for the four C2 domains, Northcutt noticed a recurring pattern in their name server configurations. Three of them used NS1/NS2.hostgator.net, while a fourth used hosterdaddy.marsbox.order as its name server subdomain — with "HostorDaddy" appearing in both cases. The name prompted an obvious question: was this a GoDaddy affiliate, a misspelling, or something else entirely?

Querying DomainTools for all apex domains using hostordaddy.net as their name server returned only 31 domains — a strikingly low number for what appeared to be a generic hosting brand. For comparison, a single GoDaddy name server returned over 3,300 domains. The disparity was a red flag: legitimate hosting infrastructure serves many customers; 31 domains on a name server that sounds like a GoDaddy knockoff suggests purpose-built malicious infrastructure.

Northcutt then queried for domains containing the string "HostorDaddy" and found three HostorDaddy-branded domains registered in 2024: hostordaddy.net, hostordaddy.in (sharing the same IP address, effectively "roommates"), and hostordaddy.com (an older VPS hosting site in the same IP neighborhood). The .net and .in variants were the operational infrastructure; the .com was adjacent but not directly linked.

Roommate Analysis: Pivoting on Shared IP Infrastructure

▶ Watch: Identifying the twelve roommate domains (12:00)

Pivoting from the HostorDaddy IP address, Northcutt identified 12 other domains sharing the same A record — what he called the "roommates." These domains all followed the same hosting-themed naming pattern: terms like serversdaddy, hostingpie, yourserversdns. The naming style matched MuddyWater's documented infrastructure conventions exactly.

Initial examination of the 12 roommate domains as traditional domains did not scream "malicious." Risk scores were mostly unremarkable; VirusTotal detections were extremely low — with one exception: serversdaddy scored 100 out of 100. But Northcutt had learned something important from the original IOC: the malicious domains were not being used as web destinations but as name server domains. This changed the analytical frame entirely.

Querying each of the 12 roommate domains as name servers, he found over 55 unique name server entries using one of the 12 domains as a primary or secondary name server. Those 55 name servers collectively pointed to more than 2,500 domains — a 625x expansion from the original four IOCs. Among those 2,500+ domains, over 1,000 had been flagged by various vendors for malware distribution, phishing, spyware, and fraud.

Notable Targets: Middle East Energy and Critical Infrastructure

▶ Watch: Targeting patterns and notable domain findings (16:01)

Digging into specific domains within the expanded set, Northcutt found targeting patterns consistent with MuddyWater's known operational profile. One cluster of domains pointed toward Middle Eastern energy sector entities. Another domain appeared to be a typosquat on Halliburton — the American multinational and the world's second-largest oil services company, and a major player in global fracking operations. The presence of an energy sector typosquat aligned closely with Iran's historical targeting of oil infrastructure in the region.

Northcutt was careful not to attribute these domains to MuddyWater with full confidence — infrastructure can be shared across multiple threat actors — but the targeting profile (Middle Eastern entities, critical infrastructure, energy) matched the group's documented preferences precisely. The domain set also included login-page-themed names suggesting credential harvesting operations, consistent with MuddyWater's phishing and espionage objectives.

Notable Quotes

"Everyone has a pattern tying their shoes. If I ask anyone in here to put their shoes on, they're gonna tie that knot the same way each time. Threat actors have this when they're setting up their malicious infrastructure — unconscious habits that they either find work well for them and continue to do."

— Austin Northcutt [[▶ 18:01]](https://www.youtube.com/watch?v=-agd3rnHl6I&t=1081s)

"When pivoting on a unique data point, consider how the actor likes to tie their shoes. At first I did think about how I would use the domains. Instead, I should have been thinking about what is the way the threat actor uses them — and that was in the name server sense."

— Austin Northcutt [[▶ 18:01]](https://www.youtube.com/watch?v=-agd3rnHl6I&t=1081s)

"Domains are multidimensional. Sometimes if you just don't get a hit on the domain, query it another way — look at it from the email domain perspective."

— Austin Northcutt [[▶ 20:01]](https://www.youtube.com/watch?v=-agd3rnHl6I&t=1201s)

Key Takeaways

• Small datasets can unlock large networks. Starting from four malicious C2 domains, passive DNS pivoting through a single unusual name server expanded the indicator set to over 2,500 domains — a 625x yield.
• Threat actors have infrastructure habits. MuddyWater consistently used two-to-three-term technology-themed domain names and reused the same name server infrastructure across operations. Recognizing these patterns is the key to effective pivoting.
• Name servers are first-class IOCs. Many analysts treat name servers as background metadata. This case shows that a malicious name server domain can be more valuable than the hosted domains themselves — each one potentially unlocking hundreds of associated indicators.
• Low VirusTotal scores don't mean clean. Eleven of the twelve roommate domains appeared unremarkable when analyzed as standard domains. Only by querying them as name servers did the malicious picture emerge, underscoring the limits of traditional indicator scoring.
• Proactive blocking is achievable. With the 55+ name servers identified, defenders can implement proactive DNS-level blocking for all domains using any of those name servers — a scalable defensive posture that disrupts the entire infrastructure cluster, not just individual domains.