[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1583-001":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1583-001","T1583.001","Domains",5,"MITRE","**What attackers do.** Attackers register or buy domain names to use for phishing, malware hosting or command and control, often choosing names that resemble legitimate brands. This serves the Resource Development tactic and happens before any contact with the victim.\n\n**How to defend.** Monitor newly registered domains and certificate transparency logs for lookalikes of your brand, register common variants of your own domains, and use takedown services. Block newly registered domains at the proxy where feasible, and publish DMARC to protect your own domain from spoofing.\n\n**Signs to look for.** Look for lookalike domains appearing in certificate logs or emails, and connections to domains only days old. A common gap is that this activity happens outside your network, so it needs external monitoring.","Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.\n\nAdversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute \"IDN homograph attacks,\" creating visually similar lookalike domains used to deliver malware to victim machines.\n\nDifferent URIs\u002FURLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1583\u002F001\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"apt36-abuses-private-github-repos-for-stealthy-c2-communications","APT36 Abuses Private GitHub Repos for Stealthy C2 Communications","2026-09-18T16:20:45.316+00:00",{"slug":25,"title":26,"published_at":27},"sality-botnet-dismantled-after-20-years-of-global-malicious-activity","Sality Botnet Dismantled After 20 Years of Global Malicious Activity","2026-09-02T10:22:18.213+00:00",{"slug":29,"title":30,"published_at":31},"sality-botnet-dismantled-via-sinkhole-operation","Sality Botnet Dismantled via Sinkhole Operation","2026-09-02T08:20:54.147+00:00",{"slug":33,"title":34,"published_at":35},"kimwolf-v7-botnet-disguises-ddos-traffic-as-legitimate-http2-browsing","Kimwolf v7 Botnet Disguises DDoS Traffic as Legitimate HTTP\u002F2 Browsing","2026-08-11T22:21:57.848+00:00",{"slug":37,"title":38,"published_at":39},"fake-software-installers-hijack-devices-for-proxy-botnet","Fake Software Installers Hijack Devices for Proxy Botnet","2026-07-09T06:21:26.944+00:00",[41,46,50,55,60,64],{"slug":42,"name":43,"problem":44,"stories":45},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",3,{"slug":47,"name":48,"problem":49,"stories":45},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":51,"name":52,"problem":53,"stories":54},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",2,{"slug":56,"name":57,"problem":58,"stories":59},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",1,{"slug":61,"name":62,"problem":63,"stories":59},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":65,"name":66,"problem":67,"stories":59},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[69,75,80,84,88,92,96,100],{"family":70,"item":71,"code":72,"title":73,"together":74},"cis","13","Control 13","Network Monitoring and Defense",4,{"family":76,"item":77,"code":78,"title":79,"together":45},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":76,"item":81,"code":82,"title":83,"together":45},"si-4","SI-4","System Monitoring",{"family":70,"item":85,"code":86,"title":87,"together":45},"7","Control 7","Continuous Vulnerability Management",{"family":76,"item":89,"code":90,"title":91,"together":54},"sc-7","SC-7","Boundary Protection",{"family":70,"item":93,"code":94,"title":95,"together":54},"17","Control 17","Incident Response Management",{"family":70,"item":97,"code":98,"title":99,"together":54},"9","Control 9","Email and Web Browser Protections",{"family":101,"item":102,"code":103,"title":103,"together":54},"itil","overview","ITIL"]