# Domain Investigation

> Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.

- **Type:** Skill
- **Install:** `agentstack add skill-liberty91ltd-cti-skills-domain-investigation`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Liberty91LTD](https://agentstack.voostack.com/s/liberty91ltd)
- **Installs:** 0
- **Category:** [Search](https://agentstack.voostack.com/c/search)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** https://github.com/Liberty91LTD/cti-skills/tree/main/skills/domain-investigation
- **Website:** https://liberty91.com/cti-skills

## Install

```sh
agentstack add skill-liberty91ltd-cti-skills-domain-investigation
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# domain-investigation

Investigate a domain or hostname end-to-end. Chain `lookup-*` skills, consolidate, prioritize follow-up IOCs, and return a rated investigation summary.

**This skill invokes:** `/lookup-virustotal`, `/lookup-urlscan`, `/lookup-shodan`, `/lookup-otx`, `/lookup-ransomwarelive`, optionally `/lookup-censys`, optionally `/lookup-reversinglabs` (network threat-intel from RL malware corpus), optionally `/lookup-crowdstrike` (IOC reputation + actor/malware links), optionally `/lookup-misp` and/or `/lookup-opencti` (internal correlation), then `/source-assessment`, `/tlp-guide`, `/confidence-levels`.

## When to invoke

- User asks to investigate, check, or enrich a domain / hostname
- User pastes a suspicious domain and asks "what is this?"
- `/url-investigation` hands off the parent domain for deeper context
- `/ip-investigation` surfaced a hostname worth investigating

## Inputs

```yaml
indicator: 
context: 
tlp_ceiling: 
```

## Procedure

### 1. Validate + triage

- Confirm it parses as a valid domain (reject IPs, URLs — route those to the right skill)
- Check for obvious false positives (top 1M domains, your own infrastructure)
- Check `data/iocs/` for prior enrichment

### 2. Parallel lookups

```
/lookup-virustotal domain     # reputation + WHOIS-ish
/lookup-urlscan domain        # existing scans (search, not submit)
/lookup-shodan domain         # DNS resolve + host fingerprint of the resolved IP
/lookup-otx domain            # community pulses + passive DNS
/lookup-ransomwarelive search --q    # victim-status sweep
```

For the ransomware.live sweep, derive an `org-candidate` from the domain by stripping the public suffix and any common subdomains (`www.acme-corp.com` → `acme-corp` or `acme corp`). If the apex contains a hyphen or dot, also try the first label alone. The PRO tier returns the full match set in one call (no pagination), so two candidate queries cost at most two of the 3000-call daily budget.

**Add to the same parallel batch if credentials are configured**:
```
/lookup-reversinglabs domain             # if $REVERSINGLABS_USER is set. Network reputation from RL's malware-analysis corpus — files seen resolving / contacting this domain, RL classification. One API call.
/lookup-crowdstrike indicator            # if $CROWDSTRIKE_CLIENT_ID is set. Falcon Intel view — malicious confidence, linked actors + malware families, report refs. One API call.
/lookup-misp search-attributes --value   # if $MISP_URL + $MISP_KEY are set. Internal correlation against your own catalogued events.
/lookup-opencti lookup                   # if $OPENCTI_URL + $OPENCTI_TOKEN are set. Internal correlation against your OpenCTI knowledge base (observables + indicators in one call).
```

Optionally (escalation):
```
/lookup-censys search "services.tls.certificates.leaf_data.subject.common_name: "
# ONLY if certificate pivoting is valuable; costs a query credit
```

### 3. Consolidate

```yaml
indicator: 
type: domain
consolidated_verdict: malicious | suspicious | clean | unknown
reputation:
  vt_detection_ratio: 
  vt_categories: []
  otx_pulse_count: 
registration:
  registrar: 
  creation_date: 
  age_days: 
dns:
  resolved_ip: 
  passive_dns: []
  ns: []
hosting:
  asn: 
  org: 
  country: 
  certificates: 
content:
  urlscan_verdict: 
  urlscan_screenshot: 
community_context:
  pulse_count: 
  malware_families: []
  attributed_actors: []
ransomware_status:
  matched_total:              # total leak-site claims matching org-candidate
  high_confidence_matches:       # only entries where website OR title clearly maps to the domain
    - victim_id: 
      title: 
      group: 
      country: 
      sector: 
      published: 
      website: 
      description_excerpt: 
      permalink: 
  notes: 
pivot_candidates:
  - type: ip
    value: 
    reason: resolves_to
  - type: domain
    value: 
    reason: shares_tls_cert
  - type: hash
    value: 
    reason: downloaded_from
```

### 4. Prioritize pivots

1. **Resolved IP** (always — then `/ip-investigation` on it if suspicious)
2. **TLS certificate siblings** (strong infrastructure link)
3. **Newly-registered-domain clusters** (if created_date "
tlp: AMBER
confidence: 
summary: 
verdict: 
reputation: 
registration: 
dns: 
hosting: 
content: 
community_context: 
pivot_candidates: 
source_ratings: 
investigation_date: 
recommended_next_steps: 
```

## Special cases

- **Newly-registered domains (<7 days)** — very common in phishing campaigns; flag even if low reputation score yet. Pivot aggressively to find sibling domains.
- **Parked/sinkhole domains** — URLScan will show a parking page; don't treat as malicious automatically.
- **Subdomain of a known CDN** (e.g., `xyz.cloudfront.net`) — the interesting data is the hostname pattern + what it fronts, not the CDN itself.

### Ransomware-claim hits — handle with care

A match in `ransomware_status` does **not** prove the queried domain's owner has been breached. Validate before reporting:

1. **Cross-check the `website` field on the victim record.** If it contains the queried domain (or its apex), confidence is high. If it's blank or a different domain, treat as a possible name collision.
2. **Common-name collisions.** Generic apex strings (`acme`, `apple`, `delta`, `chase`) match many unrelated organisations. Always inspect 2–3 top results manually rather than trusting `matched_total` alone.
3. **Credibility split.** Per `/lookup-ransomwarelive`, group attribution + dates are B2 (probably true), but the criminal-written `description` field is B3–B4 (often inflated). Quote selectively and never present a leak-site claim as a confirmed breach without independent corroboration.
4. **No-hit doesn't mean clean.** Ransomware.live only tracks public *leak-site* claims. Quietly-paid victims and intrusions that didn't escalate to extortion never appear.

## Related skills

- `/ip-investigation`, `/url-investigation`, `/hash-investigation`
- `/indicator-pivoting` — deeper graph pivoting
- `/threat-actor-profiling` — if domain attributes to a known actor (use `/lookup-ransomwarelive group-profile` for ransomware groups)
- `/ransomware-ecosystem` — knowledge cell to consult when a victim hit lands
- `/cti-orchestrator`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** [Liberty91LTD/cti-skills](https://github.com/Liberty91LTD/cti-skills)
- **License:** MIT
- **Homepage:** https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-liberty91ltd-cti-skills-domain-investigation
- Seller: https://agentstack.voostack.com/s/liberty91ltd
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.