Back to case studies
Advanced1 h 30 - 2 h
Mapping malicious infrastructure
Starting from a single phishing domain, pivot on the IP, certificates, favicon and registration data to uncover the rest of the attacker’s infrastructure.
Briefing
A partner bank sends you an active phishing domain: secure-access-nordbank.example. It wants to know whether other domains from the same campaign exist, to block them proactively. You have results from passive DNS, Certificate Transparency, Shodan and RDAP. All the work is passive.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Assess how strong each pivot is
- Use TLS certificates
- Use the favicon hash
- Cross-check registration data
- Deliver a reliable IOC list
Tools used in real investigations
VirusTotal / RiskIQcrt.sh / CensysShodan (http.favicon.hash)RDAPurlscan.ioMaltego
100% Free
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.