DomainTools 101: Blocking and Tackling Bad Domains

This DomainTools investigation describes uncovering a malvertising campaign where an attacker reused an expired brand domain to distribute malware; using reverse-IP pivoting and a reputation/risk score engine the analyst identified additional domains and infrastructure (including an IP hosting multiple malicious domains) and recommends blocking the discovered domains, searching internal logs for indicators, and enabling monitoring of registrants, name servers, and IPs to detect and prevent further activity.