Something's Phishy: See the Hook Before the Bait

Something's Phishy: See the Hook Before the Bait

Speaker: Malachi Walker

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=aQmgF_rFieI

Reading time: 7 minutes

TL;DR

DNS forensics is one of the most underutilized tools in threat hunting and incident response. Malachi Walker from DomainTools argues that by treating domains as characterizers, connectors, and identifiers — and by leaning on passive DNS — security teams can identify malicious infrastructure before the phishing lure ever lands in a victim's inbox.

Introduction

The title of this talk is itself a demonstration of its core thesis. "Something's Phishy: See the Hook Before the Bait" sounds like a talk about phishing emails or social engineering. It is actually a talk about DNS adversary infrastructure. The audience was given the bait in the title and the hook in the abstract — and as Walker noted, only the people who read the abstract knew what was really coming. That gap between what looks safe and what is actually safe is precisely the problem DNS intelligence is designed to close.

Walker, a threat intelligence researcher at DomainTools, presented findings from the company's 2025 Domain Tools Investigation Report, weaving in hands-on examples of malicious infrastructure identification. His central argument: DNS is forensic gold. Attackers must use it. It records their intent. And it can be queried, pivoted, and correlated in ways that expose entire campaigns before they strike.

The talk was structured around a Game of Thrones / Westeros framing tied to the BSidesSF 2025 conference theme of "Here Be Dragons" — an apt metaphor for threat actors lurking in infrastructure that looks ordinary until examined closely.

Everything Is a DNS Problem

▶ Watch: DNS as the foundation of threat intelligence (06:30)

Walker opened with a sentiment familiar to any incident responder: "It's not DNS. It can't be DNS." And then: it was always DNS. Every phishing campaign, every C2 channel, every data exfiltration destination touches DNS. Verizon's research attributes the majority of threats to DNS involvement; InfoBlox puts the number at 93%.

The key insight Walker emphasized is that domains carry the attacker's intent. A domain like employeeportal-login.com is designed to fool humans — plausible enough to trick a quick glance, suspicious enough to catch a careful eye. Domains that look like random character strings are designed to fool machines, often used for C2 or DNS-based data exfiltration. And domains with deliberate typosquatting — a Blue Cross or Kaiser Permanente lookalike — are an attempt to blend into expected traffic. Recognizing intent from domain structure is the first step in turning DNS data into actionable intelligence.

Walker framed domains as serving three roles in threat analysis. As a characterizer, a domain reveals what the attacker is trying to do and who they are trying to fool. As a connector, domain registration data — email addresses, IP addresses, name servers — links one piece of infrastructure to a larger network of related assets the analyst may not have seen yet. As an identifier, domain registration data can sometimes point directly to real individuals, particularly as threat actors using large language models have been observed registering domains with their full legal names, phone numbers, and home addresses.

The Limitations of Active DNS and Why Passive DNS Matters

▶ Watch: Passive DNS explained (14:00)

Active DNS has a fundamental limitation: it was designed 40 years ago without deceptiveness in mind. Adversaries can change their infrastructure between queries. An IP address observed pointing to a malicious domain today may point elsewhere tomorrow. And standard DNS only resolves domain to IP, not IP to domain.

Passive DNS addresses both limitations. It operates as a shadow layer above the standard resolution path — recording historical DNS resolutions without the queried party knowing they are being investigated. This means an analyst can repeatedly query a target's infrastructure without alerting them to the investigation. Critically, passive DNS supports reverse lookups: given an IP address, it can return all domains that have resolved to it over time.

The pivot points available through passive DNS include FQDNs (fully qualified domain names), IP addresses, registrar data, name server data, and SSL certificate attributes. Walker described this as the real investigative power: one data point becomes many, and one suspicious domain can expand into a map of an entire adversary infrastructure ecosystem.

The wolf pack analogy Walker invoked — drawn from the Stark direwolves in Game of Thrones — captures this well: threat actors rarely operate with a single domain and a single piece of infrastructure. They are packs. Passive DNS lets analysts track the pack from a single thread.

Infrastructure Patterns from the DomainTools Investigation Report

▶ Watch: Key findings from the investigation report (20:30)

Walker shared several findings from DomainTools' 2025 Investigation Report, which analyzed patterns in malicious infrastructure across tens of thousands of domains.

A 3D scatter plot visualizing the top registrars, ISPs, and name server domains showed a notable concentration of high-volume malicious domains clustering around a small number of providers. The visualization, Walker noted, reveals "dominant provider groupings" — a handful of registrars and hosting providers disproportionately associated with high-risk domains.

On the topic of top-level domains (TLDs), the report found that while most malicious traffic still flows under .com, .org, and .net, new TLDs introduce recurring spikes. Each time a new TLD is introduced, there is a rush of registrations — many legitimate (new TLDs are often cheaper or even free), but providing cover for threat actors to slip through detection systems that are tuned primarily against the classic TLDs. Walker flagged these new-TLD registration spikes as low-hanging fruit for automated blocking strategies.

The report also documented the impact of high-publicity events on domain registration patterns. During the California wildfires, a surge of opportunistic domains appeared — exploiting the emotional weight of the event to lower victims' guard and manufacture urgency. Attackers, Walker observed, are skilled at weaponizing public attention.

Two Catches of the Day: Finding Malicious Domains Before They Strike

▶ Watch: Live examples of domain discovery (26:45)

Walker walked through two concrete examples of adversary infrastructure discovery in the wild.

In the first, he searched for domains containing the word "support" — reasoning that threat actors frequently build credential-harvesting infrastructure around plausible support-related domain names. The search surfaced a cluster: instagram-support-e.com, support-online.com (mimicking a crypto exchange), instagram-support.com, and even an fdic.up-support variant. These domains were consistently rated zero (clean) by automated threat intelligence feeds at the time of discovery. Walker's point: blocklists require prior victims. Finding infrastructure at a zero rating means the analyst has found it before harm occurs and before the attacker knows to burn it.

The second example involved trustwalletup-support.com, which Walker showed was clearly designed to harvest cryptocurrency wallet credentials. Passive DNS resolution showed the domain associated with a mail record pointing to mail.trustwallet.com variants — confirming the infrastructure was configured for phishing activity.

Both examples illustrated a pattern Walker emphasized repeatedly: threat actors are lazy about infrastructure reuse. The same IP address, the same registrar account, the same name server configuration used for one campaign will appear again in the next. Catching one domain in a cluster exposes the rest.

Practical Tooling and Detection Configuration

Walker described a Splunk-based detection approach — though he noted the same logic applies to any SIEM — focused on three prioritized signals: young domains (registered under 48 hours ago), domains matching patterns observed in prior phishing campaigns, and newly observed domains making first-time contact with the organization. The operational heuristic: not all young domains are malicious, but a high proportion of malicious domains are young.

For automated enrichment and pivoting, Walker recommended Spiderfoot, a reconnaissance tool available within Kali Linux, for gathering full infrastructure context. For correlated analysis of passive DNS findings, he described using regular expressions to identify suspicious subdomain patterns and cross-referencing those patterns with a large language model (on a personal device, given enterprise AI policy constraints) to surface contextual signals.

The MITRE ATT&CK framework maps cleanly to DNS-centric detection: phishing delivery, watering hole attacks, internal spear-phishing, lateral movement, and C2 communication all leave DNS traces. Addressing infrastructure at the DNS layer provides visibility across many of these TTPs from a single vantage point.

Notable Quotes

"It's very hard for them to use DNS to hide. You can lie with DNS, but you can't hide."

"Not all young domains are bad, but a lot of bad domains are young."

"If you can find infrastructure while it's at a zero, you're going to be a lot more likely to make more connections and uncover some adversary infrastructure."

Key Takeaways

• DNS is forensic gold. Attackers must create and use internet infrastructure, and DNS records that activity. Passive DNS lets analysts query it without alerting the target.
• Treat domains as characterizers, connectors, and identifiers. A single suspicious domain can reveal attacker intent, link to an entire infrastructure cluster, and sometimes point directly to real individuals.
• Blocklists are reactive by design. Finding malicious infrastructure before it appears on a blocklist — when it still scores zero across threat intel feeds — provides the best opportunity for connection-mapping and proactive blocking.
• New TLDs create detection blind spots. Each new TLD introduction generates a spike of registrations that detection tools tuned to classic TLDs may miss. Monitor new TLD activity as an early warning signal.
• Threat actors are lazy. They reuse registrar accounts, IP addresses, and name server configurations. Discovering one domain in a campaign frequently exposes the whole pack.