Domain Investigation

domain-investigation

Investigate a domain or hostname end-to-end. Chain lookup-* skills, consolidate, prioritize follow-up IOCs, and return a rated investigation summary.

This skill invokes: /lookup-virustotal, /lookup-urlscan, /lookup-shodan, /lookup-otx, /lookup-ransomwarelive, optionally /lookup-censys, optionally /lookup-reversinglabs (network threat-intel from RL malware corpus), optionally /lookup-crowdstrike (IOC reputation + actor/malware links), optionally /lookup-misp and/or /lookup-opencti (internal correlation), then /source-assessment, /tlp-guide, /confidence-levels.

When to invoke

• User asks to investigate, check, or enrich a domain / hostname
• User pastes a suspicious domain and asks "what is this?"
• /url-investigation hands off the parent domain for deeper context
• /ip-investigation surfaced a hostname worth investigating

Inputs

indicator: 
context: 
tlp_ceiling: 

Procedure

1. Validate + triage

• Confirm it parses as a valid domain (reject IPs, URLs — route those to the right skill)
• Check for obvious false positives (top 1M domains, your own infrastructure)
• Check data/iocs/ for prior enrichment

2. Parallel lookups

/lookup-virustotal domain     # reputation + WHOIS-ish
/lookup-urlscan domain        # existing scans (search, not submit)
/lookup-shodan domain         # DNS resolve + host fingerprint of the resolved IP
/lookup-otx domain            # community pulses + passive DNS
/lookup-ransomwarelive search --q    # victim-status sweep

For the ransomware.live sweep, derive an org-candidate from the domain by stripping the public suffix and any common subdomains (www.acme-corp.com → acme-corp or acme corp). If the apex contains a hyphen or dot, also try the first label alone. The PRO tier returns the full match set in one call (no pagination), so two candidate queries cost at most two of the 3000-call daily budget.

Add to the same parallel batch if credentials are configured:

/lookup-reversinglabs domain             # if $REVERSINGLABS_USER is set. Network reputation from RL's malware-analysis corpus — files seen resolving / contacting this domain, RL classification. One API call.
/lookup-crowdstrike indicator            # if $CROWDSTRIKE_CLIENT_ID is set. Falcon Intel view — malicious confidence, linked actors + malware families, report refs. One API call.
/lookup-misp search-attributes --value   # if $MISP_URL + $MISP_KEY are set. Internal correlation against your own catalogued events.
/lookup-opencti lookup                   # if $OPENCTI_URL + $OPENCTI_TOKEN are set. Internal correlation against your OpenCTI knowledge base (observables + indicators in one call).

Optionally (escalation):

/lookup-censys search "services.tls.certificates.leaf_data.subject.common_name: "
# ONLY if certificate pivoting is valuable; costs a query credit

3. Consolidate

indicator: 
type: domain
consolidated_verdict: malicious | suspicious | clean | unknown
reputation:
  vt_detection_ratio: 
  vt_categories: []
  otx_pulse_count: 
registration:
  registrar: 
  creation_date: 
  age_days: 
dns:
  resolved_ip: 
  passive_dns: []
  ns: []
hosting:
  asn: 
  org: 
  country: 
  certificates: 
content:
  urlscan_verdict: 
  urlscan_screenshot: 
community_context:
  pulse_count: 
  malware_families: []
  attributed_actors: []
ransomware_status:
  matched_total:              # total leak-site claims matching org-candidate
  high_confidence_matches:       # only entries where website OR title clearly maps to the domain
    - victim_id: 
      title: 
      group: 
      country: 
      sector: 
      published: 
      website: 
      description_excerpt: 
      permalink: 
  notes: 
pivot_candidates:
  - type: ip
    value: 
    reason: resolves_to
  - type: domain
    value: 
    reason: shares_tls_cert
  - type: hash
    value: 
    reason: downloaded_from

4. Prioritize pivots

1. Resolved IP (always — then /ip-investigation on it if suspicious)
2. TLS certificate siblings (strong infrastructure link)
3. Newly-registered-domain clusters (if created_date "

tlp: AMBER confidence: summary: verdict: reputation: registration: dns: hosting: content: communitycontext: pivotcandidates: sourceratings: investigationdate: recommendednextsteps:

## Special cases

- **Newly-registered domains (<7 days)** — very common in phishing campaigns; flag even if low reputation score yet. Pivot aggressively to find sibling domains.
- **Parked/sinkhole domains** — URLScan will show a parking page; don't treat as malicious automatically.
- **Subdomain of a known CDN** (e.g., `xyz.cloudfront.net`) — the interesting data is the hostname pattern + what it fronts, not the CDN itself.

### Ransomware-claim hits — handle with care

A match in `ransomware_status` does **not** prove the queried domain's owner has been breached. Validate before reporting:

1. **Cross-check the `website` field on the victim record.** If it contains the queried domain (or its apex), confidence is high. If it's blank or a different domain, treat as a possible name collision.
2. **Common-name collisions.** Generic apex strings (`acme`, `apple`, `delta`, `chase`) match many unrelated organisations. Always inspect 2–3 top results manually rather than trusting `matched_total` alone.
3. **Credibility split.** Per `/lookup-ransomwarelive`, group attribution + dates are B2 (probably true), but the criminal-written `description` field is B3–B4 (often inflated). Quote selectively and never present a leak-site claim as a confirmed breach without independent corroboration.
4. **No-hit doesn't mean clean.** Ransomware.live only tracks public *leak-site* claims. Quietly-paid victims and intrusions that didn't escalate to extortion never appear.

## Related skills

- `/ip-investigation`, `/url-investigation`, `/hash-investigation`
- `/indicator-pivoting` — deeper graph pivoting
- `/threat-actor-profiling` — if domain attributes to a known actor (use `/lookup-ransomwarelive group-profile` for ransomware groups)
- `/ransomware-ecosystem` — knowledge cell to consult when a victim hit lands
- `/cti-orchestrator`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** [Liberty91LTD/cti-skills](https://github.com/Liberty91LTD/cti-skills)
- **License:** MIT
- **Homepage:** https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.