Use DNS to Detect Domains Abused for Phishing
Dutch Tax and Customs investigator Karl Lovink uses DNS telemetry and Splunk to detect fraudulent domains abusing agency brands for phishing in real time.
Summary
Public Sector Organizations as Prime Phishing Targets
Government tax and revenue agencies face constant brand impersonation campaigns where cybercriminals launch fraudulent domains and spoofed emails to defraud citizens.
Leveraging DNS and SPF Telemetry for Proactive Detection
Karl Lovink details developing custom Splunk analytics that monitor global DNS queries and Sender Policy Framework (SPF / RFC 7208) lookups in real time.
Identifying Impersonation Domains Before Email Dispatch
Because phishing infrastructure queries the target's SPF record before launching mass email blasts, tracking SPF DNS telemetry provides an instant early-warning indicator.
Automated Takedowns and Citizen Protection
Lovink demonstrates automated response workflows that instantly blacklist newly identified phishing domains and initiate registrar takedowns.
Related talks
Black Hat·47 min
Analysts investigate attack surfaces and defenses concerning How to Detect that Your Domains are Being Abused for Phishing by Using DNS.
Videos·47 min
Analysts investigate attack surfaces and defenses concerning AttackIQ + Splunk SIEM Integration.
botconf eu·22 min
Yarin Ozery
Yarin Ozery examines The Case For Real Time Detection of Data Exchange Over the DNS Protocol.