IP and Domain Threat Intel

Security Operations runbooks revolve around the process verify → enrich → decide, and IP and domain enrichment remains a core skill any L1 should have. In this room, we will pivot on geolocation, ASNs, open-service footprints, and DNS records to decide whether the indicator is malicious or not, and also get some additional context about the attack.

Learning Objectives

• Enrich domains with WHOIS age, DNS records, and TLS details
• Learn the concepts of ASNs and geolocation for SOC triage
• Spot red-flag services using VirusTotal, Shodan, and Censys
• Detect VPN, proxy, and Tor exit nodes with IP2Proxy and Spur
• Correlate signals across sources instead of trusting one verdict

Prerequisites

• Intro to Cyber Threat Intel
• File and Hash Threat Intel

Practice

Before we start, download the archive with the exported threat intel attached to this task. You'll need it for most of the exercises, since live threat intel changes daily, and the data you query today may look different tomorrow.