IP and Domain Threat Intel

Security Operations runbooks still revolve around the process verify → enrich → decide, but when the alert is a lone IP address or domain, the enrichment phase looks different. Instead of hashes, we pivot on geolocation, ASNs, open-service footprints, and passive DNS to learn whether a connection is routine SaaS traffic or an adversary foothold beacon.

Learning Objectives

By the end of this room, you will be able to:

• Understand IP and domain threat intelligence for a SOC.
• Geolocate IPs and interpret their Autonomous System Numbers (ASNs).
• Detect red-flag infrastructure via Shodan/Censys service banners.
• Assess reputation with various tools.
• Enrich domains with WHOIS age, DNS records, and certificate transparency.

Prerequisites

• Intro to Cyber Threat Intel
• File and Hash Threat Intel

Scenario

It is Wednesday morning. The SOC has flagged two suspicious domains in phishing emails and three IP addresses in outbound proxy logs. You are tasked with triaging all seven artefacts, enriching them with context, and recommending actions with expiry.

• advanced-ip-sccanner[.]com
• 166[.]1[.]160[.]118
• 64[.]31[.]63[.]194
• 69[.]197[.]185[.]26
• 85[.]188[.]1[.]133