WHOIS Your Daddy: Tracking Iranian-backed Cyber Operations...
summary
Investigation begins from four malicious IOCs and uses passive DNS and registration WHOIS pivots to link a unique name server hosterdaddy.net to 12 co‑hosted “roommate” domains, 55 derived name servers and over 2,500+ domains in total. Many of those domains show VirusTotal or vendor detections for malware distribution, phishing and spyware, and include typosquats targeting regional companies; the method builds a reproducible infrastructure blocklist rather than relying on single domain heuristics.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:20RDAP and the talk
- 1:04Bottom line and structure
- 2:32Speaker background
- 3:38Muddy Water malware
- 5:48Investigating name servers
- 6:50Who is Hosterdaddy?
- 10:40Hosterdaddy's roommates
- 12:25Name server analysis
- 14:07Querying as name servers
- 15:10Malicious domain detections
- 16:35Targeted industries
- 17:18Research takeaways
- 19:30Domains are multi-dimensional
related talks
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
31mInfluencer Vaccine: Identifying Information Operations Infrastructure
52mIran's Soft-War for Internet Dominance
16mhijacking.gov.uk - Identifying and Communicating Risks to the Digital State
20mYour Persistent Friend: The Untold History of Iran’s Effectiveness in Using...
47mDNS On Fire
40mDid Subdomain Abuse by BlackTech “Evolve”?