Iris Investigations At-A-Glance: How to Pivot on Domain Data for Agile and Intelligent Threat Response

A case study of an aggressive phishing campaign targeting Sagawa Express customers in Japan: attackers used lookalike domains (e.g., sagawa-app.com) and a malicious Android dropper (sagawa.oicp.io) to harvest credentials and payment data. DomainTools demonstrates using Iris Investigate (WHOIS history, passive DNS, screenshots, SSL and risk scores) to pivot from initial indicators, identify ~65 associated malicious domains, related hosting IPs and IOCs, and support takedown actions by JPCERT/CC.