Investigating cyber attacks using domain and DNS data

Abstract

In July 2020, more than 130 high-profile, verified Twitter accounts were compromised. The accounts, which included the personal accounts of Elon Musk, Bill Gates, Kanye West and then-US presidential candidate Joe Biden, shared tweets calling for people to send money to a bitcoin wallet with the promise that they would be sent back double the amount in return. 1 The majority of cyber attacks leverage the central role that DNS plays in facilitating Internet traffic. From botnets spreading disinformation and undertaking distributed denial of service (DDoS) attacks to sophisticated spear-phishing campaigns, attackers typically will set up dozens, hundreds or even thousands of malicious domains to stay one step ahead of detection systems and blacklists. These leave a trail that can provide insight into the attackers’ real motivations and even lead to the perpetrators, explain Chad Anderson, John ‘Turbo’ Conwell and Tarik Saleh of DomainTools.