Malicious Domains: A Cybersec Foundation

Insights

Malicious domains are a foundational layer of threat intelligence and provide critical visibility into where attackers operate online. You can integrate domain-based intelligence across your security stack to: enhance prevention with DNS filtering and firewall rules, improve detection via IDS/IPS systems, guide SOAR-driven response playbooks, and support retrospective threat hunting. Their versatility makes them valuable for organizations of any size because they serve as both a frontline defense and an investigative asset.

Why Domains (Not Just IPs) Matter

Blocking domains offers a more precise and effective way to deny access to malicious infrastructure compared to blocking at the IP-level. Unlike IP addresses, which are often shared across many services and tenants (e.g., cloud providers), domains tend to be unique to the threat actor’s campaign or infrastructure. Blocking a malicious IP risks affecting legitimate services; blocking a malicious domain is more targeted and typically less prone to false positives.

Where to Get Domain Blocklists

There are several sources for malicious domain blocklists:

  • Commercial Threat Intelligence Vendors – They offer curated, regularly updated feeds, often enriched with context like first-seen dates, associated malware families, or related indicators (IPs, hashes, etc.).
  • Open Source Intelligence (OSINT) – Communities such as Abuse.ch, PhishTank, and threat-sharing platforms publish free lists. While useful, they can vary in accuracy, timeliness, and depth of context.
  • Internal Sources – Your organization’s own detection systems (e.g., sandboxing, phishing reports) can be a powerful generator of high-confidence domains worth adding to local blocklists.

Of course, not all feeds are created equal. Freshness, coverage, and enrichment are key to determining how useful a feed is in real-world defensive operations.

The Importance of Freshness and Context

Threat actors continuously evolve their infrastructure. Domains can be registered and weaponized within minutes. That’s why static or infrequently updated lists are of limited use. A quality feed should not only be updated frequently, ideally hourly or daily, but also provide context: Why is this domain flagged? Is it linked to a specific malware family? Was it part of a known phishing kit? When was it first detected?

Rich metadata and context allow security teams to make informed decisions. For example, knowing a domain is associated with a known command-and-control server for a particular ransomware strain might justify more aggressive response actions than if it were merely flagged for spam.

How to Use Malicious Domain Feeds

You can integrate domain intelligence into your environment in several ways:

  • Network Controls – Feed domains into firewalls, DNS security tools, or secure web gateways to block access in real time.
  • IDS/IPS Systems – Tools like Suricata or Snort can inspect DNS traffic for requests to known bad domains and generate alerts or drop packets.
  • SIEMs and SOARs – Enrich alerts with domain context to improve triage speed and accuracy.
  • EDR and XDR – Use domain feeds to flag suspicious outbound connections from endpoints and correlate with other malicious activity.
  • Threat Hunting – Historical DNS logs or proxy logs can be cross-referenced against the feed to identify prior compromise.
Best Practices for Operational Use
  1. Use Multiple Feeds – Every source has limitations in coverage, geography, etc. Selecting feeds from multiple vendors and publicly available offers help to maximize coverage.
  2. Automate Ingestion and Updates – Integrate feeds into your tech stack with automation tools or platforms.
  3. Monitor for Overblocking – Even with domain-level granularity, verify false positives and build feedback loops to tune your blocklists.
  4. Use Enriched Feeds for Decision Making – Context reduces alert fatigue and helps prioritize incident response.

Final Thoughts

Malicious domain feeds are a tried and true foundational element of threat prevention, detection, and response. From stopping phishing attempts to flagging command-and-control activity, domain-level intelligence provides a tactical advantage in defending against today’s fast-moving threats.

Malware Patrol offers domain intelligence designed to meet the needs of security teams who require both breadth and depth. We cover a wide range of threats, from phishing and malware to emerging threats, cryptomining, DGAs, and C2 infrastructure. Our feeds are also enriched with the metadata that helps turn alerts into action. For ease of use, we format the feeds for compatibility with the most popular security tools and platforms.

Ready to add precision and power to your defenses? Contact us to learn more or to request a free trial.

?

How big are your threat data gaps?

See for yourself.

Free Data Evaluation
?

AWS Route 53 DNS Resolver Firewall

Configuration Guide

Amazon Route 53 Resolver Firewall Integration Configuration Guide Blog post image. Image contains A grey, orange and blue background with the Amazon AWS, Route 53 and Malware Patrol logos.

There are many security tools available, each serving a unique purpose in safeguarding your digital environment. Among them, the DNS firewall is one of the most effective and well-established. It acts as a critical line of defense against cyber threats by filtering and blocking access to malware and phishing websites, and data exfiltration points among others malicious resources. This prevents users from inadvertently visiting dangerous sites or falling victim to cyber attacks.

Amazon Route 53 is a Domain Name System (DNS) service that connects user requests to Internet applications running on AWS or on-premises. Among the features this service offers is protection via the Route 53 Resolver DNS Firewall. It allows the use of AWS Managed Domain Lists, as well as custom Domain Lists (outside sources or your own). This step-by-step guide shows how to integrate Malware Patrol’s Malicious Domains threat intelligence with the AWS Route 53 Resolver DNS Firewall.

Add Malware Patrol’s Malicious Domains List to Amazon Route 53 Resolver DNS Firewall

You’ll need your Malware Patrol subscription username and password to proceed.

Malware Patrol uses CloudFormation to create all the necessary AWS systems that keep a Route 53 Domain list updated with Malware Patrol data. Basically, it creates an S3 bucket and a Lambda function that downloads and updates the Malicious Domains feed every hour, importing it into the Route 53 Domain List once it’s update.

The process is simple. Start by signing into your AWS Management Console and click the following link:

(URL will be provided by your account manager)

When you click on this link, you will see fields for inputting your Malware Patrol username and password. Click “Create Stack”. (Do NOT modify any other field on the page!) The following resources are generated automatically:

  • CloudFormation stack: DomainListForMalwarePatrolRoute53
  • EventBridge rule: ScheduleForMalwarePatrolRoute53
  • Bucket: domainlistformalwarepatr-s3bucketformalwarepatrol-RANDOMNUMBER
  • Lambda Function: LambdaForMalwarePatrolRoute53
  • DNS Firewall Domain List: malware-patrol-malicious-domains

The following screenshots show the process that begins once you have clicked on the link above.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 1

In the parameters section, enter your customer username and password.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 2

In the capabilities section, you must acknowledge the IAM resources-related information. Click “Create Stack”.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 3

The stack will show as being in progress for a few moments.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 4

Once it is complete, you will see the following screen:

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 5

Navigate to your Route 53 console. You can do this by searching Route 53 in the search bar at the top of the screen.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 6

From your Route 53 dashboard, select DNS Firewall from the left side menu.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 7

Click on Rule Groups from the DNS Firewall entry on the left side menu and then click Create rule group.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 8

Give the rule group a name and click Next.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 9

Select Add rule.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 10

Name the rule and select “Add my own domain list”. Under “Choose or create a new domain list”, select the Malware Patrol list.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 11

For Action, drop down and select BLOCK and then select NXDOMAIN. Click Add rule.

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 12

AWS Route 53 - DNS Firewall Malware Patrol Integration guide image - Step 13

Congratulations, your Malware Patrol Malicious Domains threat list is active and ready to protect your organization against the latest threats!

The next steps will vary by organization. Generally, you will want to enable firewall protection for your VPC(s). An Amazon resource outlining this process can be found below.

Notice that the newly created Domain List may take more than an hour to populate depending on how long it takes for AWS to execute the Lambda function. After that, updates will be automatically pushed every hour.

Amazon Route 53 Resources

  • Managing Your Own Domain Lists: “You can create your own domain lists to specify domain categories that you either don’t find in the managed domain list offerings or that you prefer to handle on your own.
  • Configuring logging for DNS Firewall: “You can evaluate your DNS Firewall rules by using Amazon CloudWatch metrics and the Resolver query logs. The logs provide the domain list name for all alerts and blocking actions.”
  • DNS Firewall rule groups and rules: “This section describes the settings that you can configure for your DNS Firewall rule groups and rules, to define the DNS Firewall behavior for your VPCs. It also describes how to manage the settings for your rule groups and rules.”
  • Enabling Route 53 Resolver DNS Firewall protections for your VPC: “You enable DNS Firewall protections for your VPC by associating one or more rule groups with the VPC. Whenever a VPC is associated with a DNS Firewall rule group, Route 53 Resolver provides the following DNS Firewall protections […]”

If you encounter any problems with your Route 53 DNS Resolver Firewall integration, please contact your account manager or send an email to support ( @ ) malwarepatrol.net.

Malware Patrol + Palo Alto NGFW

Configuration Guide

??

Palo Alto NGFW Configuration Guide blog post image

Malware Patrol offers the following Enterprise feeds formatted for use with the Palo Alto NGFW. Customers choose the feed(s) that meet their needs:

1) DNS-over-HTTPS (DoH) Servers: This feed gives security teams control over the use of DoH in their environment. DoH wraps DNS queries in an HTTPS request, which can disguise malicious traffic. Several malware families take advantage of this to use DoH for their C2 communications.

2) Malicious Domains: Prevent access to domains hosting malware, ransomware, phishing, cryptominers, and command and control servers (C2s) for over a hundred malware and ransomware families. Blocking C2 communication disrupts the attacker’s ability to execute malicious commands and navigate laterally within the network, essentially breaking the cyber kill chain.

3) Malicious IPs: Provides a first line of defense against threats for which signature-based indicators may not yet be available. The broad coverage of IPs may also extend protection to attacks from adversaries utilizing the same infrastructure. The feed includes IPs actively hosting malicious malware and ransomware files, phishing sites, as well as C2 servers.

4) Malware URLs: This feed contains URLs known to be hosting malware and ransomware binaries. By leveraging malicious URL feeds, security tools can block access to harmful links while still allowing legitimate services hosted on the same domain. This level of precision prevents the unnecessary blocking of popular and legitimate platforms, such as Dropbox or Google Drive, where malicious content is frequently hosted.

Integrating external threat intelligence into your organization’s firewall is a crucial step in fortifying cybersecurity defenses. Organizations gain a more comprehensive and well-rounded view of emerging threats when they diversify their information sources. Different providers may have varying expertise and access to distinct threat data, offering a broader spectrum of insights.

This multi-sourced approach enhances the firewall’s ability to detect and block a wider range of malicious activities, reducing the risk of missing critical threats. It’s a strategic move that ensures a more robust and adaptable security posture, minimizing the chances of falling victim to sophisticated cyberattacks.

Malware Patrol offers free evaluations of our threat intelligence feeds, including those for Palo Alto NGFW. Request your evaluation here.  

 

Palo Alto NGFW External Dynamic Lists

Additional threat intelligence sources are integrated into Palo Alto Networks NGFW’s PAN-OS as “External Dynamic Lists” or EDLs. According to the Palo Alto NGFW PAN-OS Administrator’s Guide: “An External Dynamic List is a text file that is hosted on an external web server so that the firewall can import objects—IP addresses, URLs, domains—included in the list and enforce policy. To enforce policy on the entries included in the external dynamic list, you must reference the list in a supported policy rule or profile. When multiple lists are referenced, you can prioritize the order of evaluation to make sure the most important EDLs are committed before capacity limits are reached. As you modify the list, the firewall dynamically imports the list at the configured interval and enforces policy without the need to make a configuration change or a commit on the firewall.” Users can add up to 30 EDLs. There are per-firewall model restrictions on the number of entries allowed for each of the following object types: 1) IP address and 2) URL & Domain. Check the above referenced administrator’s guide for more details.

Pre-Integration – External Source Certificate Profiles

When EDL sources, such as Malware Patrol, are secured with SSL, you will need a certificate profile in order to authenticate the server hosting your data feed(s). Both the root CA (certificate authority) and intermediate CA certificates are required. Per the Administrator’s Guide (link above), you should “use the same certificate profile to authenticate external dynamic lists from the same source URL. If you assign different certificate profiles to external dynamic lists from the same source URL, the firewall counts each list as a unique external dynamic list.”

To get the certificates for Malware Patrol:

1) Navigate to https://malwarepatrol.net (We used the Firefox browser – instructions will vary for others.)

2) (Left) Click on the site security padlock icon

An image in the Pre-Integration steps for the malware and palo alto networks ngfw configuration guide

3) Select Connection Secure –> More Information.

A Pre-Integration step image in the malware and palo alto networks ngfw configuration guide 

4) Click View Certificate.

A Pre-Integration step 4 image in the malware and palo alto networks ngfw configuration guide   

5) In the certificate information dialog box that appears:

  • Click on the Cloudflare Inc ECC CA-3 tab
  • Right click the PEM (cert) link
  • Select Save Link As and save as ‘root.pem’ to your computer
  • Click on the Baltimore CyberTrust Root tab
  • Right click the PEM (cert) link
  • Select Save Link As and save as ‘intermediate.pem’ to your computer.

A Pre-Integration step 5 image in the malware and palo alto networks ngfw configuration guide

A Pre-Integration step 5.1 image in the malware and palo alto networks ngfw configuration guide

A Pre-Integration step 5.2 image in the malware and palo alto networks ngfw configuration guide

A Pre-Integration step 5.3 image in the malware and palo alto networks ngfw configuration guide

Add Certificate Profiles to PAN-OS

6) Log in to your Palo Alto NGFW interface.

  • Name: Cloudflare
  • Click the +Add button at the bottom left of the CA Certificates (yellow) section of the dialog box
  • Select Import
  • Certificate Name: ‘Cloudflare – Intermediate’
  • Click Browse to find and select the ‘intermediate’ certificate saved on your computer
  • Click OK to save.

Integration step 6 paloalto login screen image in the malware and palo alto networks ngfw configuration guide

Integration step 6.1 image in the malware and palo alto networks ngfw configuration guide

Integration step 6.2 image in the malware and palo alto networks ngfw configuration guide

Integration step 6.3 image in the malware and palo alto networks ngfw configuration guide  

7) Click on the Device tab

8) Expand Certificate Management on the left side menu and then select Certificate Profile

9) Click the +Add button at the bottom left of the screen to add a new certificate profile

10)  In the Certificate Profile dialog box:

11) Repeat this process to add the second (root) certificate previously saved to your computer to the same Certificate Profile:

  • Click the +Add button again at the bottom of the CA Certificates section to add the root certificate
  • Select Import
  • Certificate Name: ‘Cloudflare – Root’
  • Click Browse to find the ‘root’ certificate saved on your computer
  • Click OK to save.

  Integration step 11 image in the malware and palo alto networks ngfw configuration guide  

12) You will see both certificates listed in the Certificate Profile window. Click OK to exit.

Integration step 12 image in the malware and palo alto networks ngfw configuration guide  

13) Click Commit in the upper right hand corner to save your changes.

Integration step 13 image in the malware and palo alto networks ngfw configuration guide  

14) Once completed, a Commit Status dialog box will appear. Make sure the result is successful.

Integration step 14 image in the malware and palo alto networks ngfw configuration guide

Add an IP EDL

15) From the Objects tab, select External Dynamic Lists on the left side menu.

16) Click the +Add button at the bottom left of the screen to add a new EDL. A dialog box will appear.

Integration step 16 image in the malware and palo alto networks ngfw configuration guide  

17) In the External Dynamic Lists dialog box:

  • Name: Malware Patrol – Malicious IPs
  • Type: IP List
  • Source: Paste the link to the IP feed from your Malware Patrol customer or evaluation portal. Insert your username and password as follows for authentication purposes: https://USERNAME:PASSWORD@eval.malwarepatrol.net/feeds/files/FILENAME
  • Certificate Profile: Cloudflare
  • Repeat: Hourly
  • Click OK to save.

Integration step 17 image in the malware and palo alto networks ngfw configuration guide  

18) Click Commit in the upper right hand corner to save your changes. Make sure the result is successful in the Commit Status window that appears after the process has completed.

Integration step 18 image in the malware and palo alto networks ngfw configuration guide

Apply a Security Policy to an IP EDL

19) From the Policies tab, select Security on the left side menu

20) Click the +Add button at the bottom left of the screen to add a new security policy

Integration step 20 image in the malware and palo alto networks ngfw configuration guide  

21) In the Security Policy Rule dialog box:

  • Name: Malware Patrol – Malicious IPs
  • Click Destination tab
  • Destination Zone: Any
  • Destination Address: External Dynamic List –> Malware Patrol – Malicious IPs
  • Click Actions tab
  • Action: Deny
  • Click OK to save.

Integration step 21-1 image in the malware and palo alto networks ngfw configuration guide

Integration step 21-2 image in the malware and palo alto networks ngfw configuration guide

Integration step 21-4 image in the malware and palo alto networks ngfw configuration guide  

22) Once again click Commit in the upper right hand corner to save your changes. Make sure the result is successful in the Commit Status window that appears after the process has completed.

Add a URL EDL

23) From the Objects tab, select External Dynamic Lists on the left side menu.

24) Click the +Add button at the bottom left of the screen to add a new EDL. A dialog box will appear.

Integration step 24 image in the malware and palo alto networks ngfw configuration guide  

25) In the External Dynamic Lists dialog box:

  • Name: Malware Patrol – Malicious URLs
  • Type: URL List
  • Source: Paste the link to the IP feed from your Malware Patrol customer or evaluation portal. Insert your username and password as follows for authentication purposes: https://USERNAME:PASSWORD@eval.malwarepatrol.net/feeds/files/FILENAME
  • Certificate Profile: Cloudflare
  • Repeat: Hourly
  • Click OK to save.

Integration step 25 image in the malware and palo alto networks ngfw configuration guide  

26) Once again click Commit in the upper right hand corner to save your changes. Make sure the result is successful in the Commit Status window that appears after the process has completed.

 

Apply a Security Policy to a URL EDL

27) From the Policies tab, select Security on the left side menu.

28) Click the +Add button at the bottom left of the screen to add a new security policy.

Integration step 28 image in the malware and palo alto networks ngfw configuration guide  

29) In the Security Policy Rule dialog box:

  • Name: Malware Patrol – Malicious URLs
  • Click Service/URL Caetgory tab
  • Service: Application-Default
  • URL Category: External Dynamic List –> Malware Patrol – Malicious URLs
  • Click Actions tab
  • Action: Deny
  • Click OK to save.

Integration step 29.1 image in the malware and palo alto networks ngfw configuration guide

Integration step 29.2 image in the malware and palo alto networks ngfw configuration guide

Integration step 29.3 image in the malware and palo alto networks ngfw configuration guide

Integration step 29.4 image in the malware and palo alto networks ngfw configuration guide

Integration step 29.5 image in the malware and palo alto networks ngfw configuration guide  

30) Once again click Commit in the upper right hand corner to save your changes. Make sure the result is successful in the Commit Status window that appears after the process has completed.

Add a Domain EDL

“An external dynamic list of type domain allows you to import custom domain names into the firewall to enforce policy using an Anti-Spyware profile or SD-WAN policy rule. An EDL in an Anti-Spyware profile is very useful if you subscribe to third-party threat intelligence feeds and want to protect your network from new sources of threat or malware as soon as you learn of a malicious domain.  […] You can also specify the firewall to include the subdomains of a specifed domain. […] When this setting is enabled, each domain in a given list requires an additional entry, effectively doubling the number of entries used by the list.”  Palo Alto NGFW PAN-OS Administrator’s Guide Malware Patrol offers these domain-based feeds for PAN-OS: Malicious Domains and DoH Servers. 

31) From the Objects tab, select External Dynamic Lists on the left side menu.

32) Click the +Add button at the bottom left of the screen to add a new EDL. A dialog box will appear.

Integration step 32 image in the malware and palo alto networks ngfw configuration guide  

33) In the External Dynamic Lists dialog box:

  • Name: Malware Patrol – Malicious Domains
  • Type: Domain List
  • Source: Paste the link to the IP feed from your Malware Patrol customer or evaluation portal. Insert your username and password as follows for authentication purposes: https://USERNAME:PASSWORD@eval.malwarepatrol.net/feeds/files/FILENAME
  • Certificate Profile: Cloudflare
  • Repeat: Hourly
  • Click OK to save.
  • Repeat this process to add Malware Patrol’s DNS-over-HTTPS Servers as an EDL.

Integration step 33 image in the malware and palo alto networks ngfw configuration guide  

34) Once again click Commit in the upper right hand corner to save your changes. Make sure the result is successful in the Commit Status window that appears after the process has completed.

Apply a Security Policy to a Domain EDL

Note: This process is slightly different from adding a security policy to IP and URL EDLs.

Add Anti-Spyware Profile

35) From the Objects tab, select expand Security Profiles on the left side menu. Click Anti-Spyware.

36) Click the +Add button at the bottom left of the screen to add a new profile. A dialog box will appear.

Integration step 36 image in the malware and palo alto networks ngfw configuration guide  

37) In the Anti-Spyware Profile dialog box:

  • Name: MalwarePatrolMaliciousDomains
  • Select the DNS Signatures tab
  • Click the +Add button at the bottom left of the External Dynamic List Domains section
  • Select External Dynamic Lists > Malware Patrol – Malicious Domains from the dropdown list
  • Repeat this process to add Malware Patrol – DOH Servers, if applicable
  • Action on DNS Queries: Apply either Block or Sinkhole to the newly added feed(s), per your organization’s needs
  • Click OK to save.

Integration step 37.1 image in the malware and palo alto networks ngfw configuration guide

Integration step 37.2 image in the malware and palo alto networks ngfw configuration guide

Integration step 37.3 image in the malware and palo alto networks ngfw configuration guide

38) Once again click Commit in the upper right hand corner to save your changes. Make sure the result is successful in the Commit Status window that appears after the process has completed.

Add a Security Policy

39) From the Policies tab, select Security on the left side menu

40) Click the +Add button at the bottom left of the screen to add a new security policy

Integration step image in the malware and palo alto networks ngfw configuration guide

41) In the Security Policy Rule dialog box:

  • Name: Malware Patrol – Malicious Domains (or DoH Servers)
  • Click Destination tab
  • Destination Zone: Any
  • Destination Address: Any
  • Click Actions tab
  • Profile Type: Profiles
  • Anti-Spyware: Select MalwarePatrolMaliciousDomains
  • Click OK to save.

Integration step 41.1 image in the malware and palo alto networks ngfw configuration guide

Integration step 41.2 image in the malware and palo alto networks ngfw configuration guide

Integration step 41.3 image in the malware and palo alto networks ngfw configuration guide

42) Once again click Commit in the upper right hand corner to save your changes. Make sure the result is successful in the Commit Status window that appears after the process has completed.  

PAN-OS Reference Document Links:

If you need any assistance with your Palo Alto NGFW integration with Malware Patrol’s data feeds, please email support ( @ ) malwarepatrol.net or contact your Account Manager.

?

Honeypots: Simple Tools that Supercharge Cybersecurity

Insights

?

honeypots

Using Honeypots for Threat Intelligence Collection

Staying ahead of malicious actors is a constant challenge. As threats continue to increase in complexity and sophistication, organizations must adopt innovative approaches to safeguard their digital assets and sensitive information. One such approach is the use of threat intelligence derived from honeypots. These deception technology tools offer a unique and invaluable insight into the tactics, techniques, and procedures employed by cybercriminals, providing organizations with the upper hand in the ongoing battle against attackers.

Honeypots are virtual or physical decoy systems designed to mimic legitimate services or applications. They can be strategically placed within an organization’s network to attract cyber attackers, diverting their attention away from actual critical assets. Another option, for research and threat intelligence gathering, is setting them up in distinct geographies via various service providers. No matter how they are deployed, the beauty of honeypots lies in their ability to capture and analyze timely data about incoming attacks without putting actual systems at risk. This data, often referred to as “honey data,” sheds light on emerging attack vectors.

1. Real-time Visibility into Attacks: Using honeypots for threat intelligence offers a front-row seat to ongoing cyber attacks. By emulating vulnerable systems and services, these traps attract a wide range of attackers attempting to exploit perceived weaknesses. The interactions between attackers and honeypots yield a wealth of information about attack methodologies, malware variants, and even potential zero-day vulnerabilities. This instant visibility enables security teams to detect and respond to threats swiftly, reducing the window of exposure and potential damage.

2. Understanding Attack Tactics: Through honeypots, organizations gain an intricate understanding of the tactics, techniques, and procedures (TTPs) employed by threat actors. Analyzing the behavior of attackers within the controlled environment of honeypots unveils their strategies, tools, and evasion techniques. This knowledge is crucial for anticipating future attacks and enhancing cybersecurity measures.

3. Prioritization and Resource Allocation: With the data derived from honeypots, organizations can effectively prioritize their cybersecurity efforts. By identifying the most prevalent attack vectors and targeting vulnerable systems, security teams can allocate resources where they are needed most. This strategic approach ensures that cybersecurity investments are optimized to mitigate the highest risks, leading to a more resilient defense posture.

Types of Honeypot Attacks

There are many different kinds of honeypots. They range from low interaction to high interaction, and can mimic just about anything: IOT devices, SSH, WordPress, databases, ICS, and APIs, to name a few. By emulating vulnerable systems, services, and applications, honeypots attract attackers and capture their activities in a controlled environment. Here are some of the key types of attacks that you can effectively detect by utilizing honeypots for threat intelligence:

  1. Break-In Attempts: Honeypots are adept at capturing break-in attempts, where attackers try to gain unauthorized access to systems or networks. By mimicking enticing entry points, such as open ports or weakly protected services, honeypots can lure attackers and record their attempts to exploit vulnerabilities.
  2. Malware Propagation: Honeypots can also detect attempts to spread malware across networks. Attackers often use compromised systems as launchpads for distributing malware to other targets. Honeypots, acting as seemingly vulnerable hosts, attract malware propagation attempts and allow researchers to analyze the behavior and characteristics of the malicious code.
  3. Port Scanning and Reconnaissance: Cybercriminals often perform port scanning to identify potential entry points into a network. Honeypots, configured with various open ports and services, can capture these scanning activities. The data collected provides insights into the attacker’s scanning techniques and the extent of their reconnaissance efforts.
  4. Credential Theft and Brute Force Attacks: Honeypots can mimic login pages and services to attract attackers attempting to steal credentials through phishing or brute force attacks. By capturing these login attempts, organizations can gain insights into the attackers’ methods and strategies for credential theft.
  5. Botnet Activities: Honeypots can act as alluring targets for botnets seeking to recruit new compromised hosts. By engaging with these botnets, researchers can gain insights into command and control mechanisms, as well as the scale and distribution of the botnet infrastructure.
  6. Distributed Denial of Service (DDoS) Reconnaissance: Attackers often conduct reconnaissance to identify potential targets for DDoS attacks. Honeypots can capture these reconnaissance activities, shedding light on the attacker’s infrastructure and the potential targets they are assessing.
  7. Exploitation of Vulnerabilities: Honeypots can replicate systems with known vulnerabilities, inviting attackers to exploit these weaknesses. This allows security teams to analyze the techniques used by attackers to compromise systems and the specific vulnerabilities they target.
  8. Insider Threat Detection: Honeypots can also be used to detect insider threats, where authorized individuals misuse their privileges to compromise systems or steal sensitive data. By tracking unusual activities within the controlled environment of a honeypot, organizations can identify potential insider threats.
  9. Zero-Day Exploits: Honeypots can be configured to mimic specific software versions and configurations that may be vulnerable to zero-day exploits. Detecting attackers attempting to exploit unknown vulnerabilities provides crucial insights into emerging threats.
  10. Command and Control (C2) Communications: Honeypots can capture communications between compromised systems and command and control servers. This helps researchers understand the communication protocols, techniques, and infrastructure used by attackers to control compromised hosts.

Introducing Malware Patrol’s Intrusion Insights Feed

Our newest offering, Intrusion Insights Data Feed, is derived from honeypots strategically deployed across the globe. Until now, our decade-old honeynet has been used for internal purposes only. We are thrilled to finally be sharing this information with our customers. The JSON-formatted data feed, updated every 15 minutes and spanning the last 36 hours of activity, provides a treasure trove of insights into live, ongoing attacks against cyber infrastructure.

Conclusion

At Malware Patrol, we believe that some of cyber security’s most mature and commonly used tools still offer high ROI and impacts well beyond those of their contemporary, super-hyped counterparts. The use of honeypots for threat intelligence collection is a dependable classic. The basics are always in style around here!

With their ability to attract, capture, and analyze attacks, honeypots provide a unique and incomparable vantage point into the strategies employed by malicious actors. Embrace the power of using honeypots for threat intelligence and request a free evaluation of our Intrusion Insights feed today.

Leslie Dawn

Technical Account Manager

Leslie Dawn is a Technical Account Manager / Threat Intelligence Analyst at Malware Patrol. Her background of nearly a decade in cyber threat intelligence provides her with a nuanced understanding of threat landscapes and client security needs.

 

?

Finding the Best Threat Intelligence Vendor

Insights

?

Everyone in our line of business wants to be considered the best threat intelligence vendor. The task of gathering and producing top-notch cyber threat intelligence (CTI) is harder than you might think, however. Here are a few reasons why:

(1) It’s literally impossible to gather information about every threat, so, CTI vendors have to accept a suspense-ridden level of imperfection. All this while knowing that it takes only one incident to cause great damage to our customers.

(2) The proper – or at least, consistent – attribution and categorization of threats is a mindblowingly-tedious-bordering-on-futile task. (Have you seen how many aliases there are for the Lazarus Group?) But without some attempt of doing so, crucial context, like TTPs, is lost.

(3) Known, active indicators number in the billions. And threat actors constantly swap out their infrastructure. Keeping this amount of data current and false positive-free is a never-ending job that requires a delicate balance of automation and human quality control.

As for #1, we threat intelligence vendors can only strive to do our best, and avoid false advertising because no one likes a liar. The second item on this list requires a MacGyver-like skillset, a super knowledgeable cybersecurity team, and a LOT of lookup tables. Number three, while challenging, is an area where threat intelligence vendors can have some control and differentiate themselves.

For example, at Malware Patrol, our systems visit each indicator at least once per day to verify its status. Inactive = Bye-Bye. And as a rule, we have never included publicly available data in our feeds unless it can be verified by our own proprietary systems. While this limits our data feed sizes, as far as we’re concerned, a random list of malicious IPs is just that. Without confirmation or context, there is no confidence. The result of applying our “quality over quantity” mantra is Malware Patrol’s actionable, high-confidence threat intelligence feeds.

Quality over Quantity or It’s a Numbers Game?

Here’s where we are going to contradict ourselves, a little. Or maybe it’s more of a tangent.

Even though our team works hard to make Malware Patrol one of the best threat intelligence vendors out there, we have been repeatedly forced to concede that cyber criminals are as determined, resourceful, and intelligent as we are. New campaigns, threat actors, and TTPs are disclosed daily. Each advance on our side is met with one on theirs. It is the ultimate Olympic table tennis match.

The “constantly changing threat landscape” reality forces cybersecurity companies to re-evaluate, innovate, and evolve our offerings probably more frequently than in any other industry. Malware Patrol is no exception.

During a recent brainstorming session, our team decided to “play the numbers game” in order to increase our threat coverage. To accomplish this without risking the quality of our data, we added a separate open source intelligence offering, described below. Our reasoning was that there is really no match for the breadth and timeliness of data gathered and shared by a global community. With some caveats, of course! Keep reading.

 

OSINT: You (Don’t) Get What You (Don’t) Pay For

There are several undeniable benefits of using OSINT as a threat intelligence vendor and practioner. It can help to improve the completeness and speed of threat intelligence. This is particularly important in the case of rapidly evolving threats, where timely intelligence can be critical. By leveraging the knowledge and work of many people, OSINT can help to fill in gaps and provide insights that would otherwise be unavailable.

However, there are some major challenges that come with using open source intelligence. The most obvious of these is the vast amount of data available. It can be mission impossible to sift through so much information, i.e., looking for a needle in a haystack. And who has time for that these days?

And when OSINT collectors are not looking for specific pieces of information or indicators, but rather trying to gain general insights into a particular topic or issue, the data set is potentially even bigger and without a doubt more complex to analyze. It requires being able to quickly scan large amounts of data and identify patterns or trends.

As we have previously mentioned, it is difficult to find reliable sources of information and OSINT is no exception. Because anyone can contribute to an open source, the quality of the information can vary greatly. There is no guarantee of accuracy and no support.

It can also be difficult to access the information contained within some OSINT sources. Often, the data is stored behind paywalls or requires special login credentials. Additionally, some types of data (such as video or audio) may not be easily accessible without specialized software or hardware.

As a cybersecurity professional, it is your job to protect your organization using your team’s technical abilities paired with your finite financial resources. As such, it behooves you to thoroughly evaluate everything used in your cybersecurity efforts, from outsourced services to tools and OSINT.

You may have guessed this next part already: paid threat intelligence services help eliminate these challenges. As a threat intelligence vendor, we specialize in and dedicate resources to the challenges listed above. That makes them our problems, not yours. Put simply, it is our job to “make” CTI and try to be the best threat intelligence vendor.

 

Open Source Intelligence (OSINT) the Malware Patrol Way

So, now it is time to (re)introduce our three new OSINT-based data feeds. They contain curated data derived from our geographically diverse network of honeypots as well as trusted third-party sources. And to be clear, these feeds will remain SEPARATE from our commercial data feeds.

  • High Risk IPs: Addresses involved in a range of malicious activities, such as spam, break-in attempts, malware distribution, botnets, and command-and-control communications.
  • Risk Indicators: A variety of threat related IoCs, including: MD5, SHA1, and SHA256 hashes, email addresses, cryptocurrency addresses, and CVEs.
  • Tor Exit Nodes: Addresses of active Tor exit nodes as reported by the Tor Project. Frequently involved in malicious activities, it is advisable to monitor, if not block, traffic from these IPs.

Here’s how we are doing OSINT the Malware Patrol way:

  • We enrich the feeds with decision-enhancing context that may include the associated malware family, threat actor, article links, and any other available metadata.
  • Entries are removed at regular intervals to make sure the data stays fresh.
  • Our team manages the data quality and sources closely.

Register for Malware Patrol’s OSINT feeds here.

 

Conclusion

To bring this all to a conclusion, we believe that being the best threat intelligence vendor does not simply mean having more indicators than the competition. Instead, an organization that provides an honest, accurate assessment of their data’s coverage upfront is less likely to over promise and under deliver. A laser focus on the quality of their threat intelligence is also crucial.

When combined with the willingness to constantly and creatively adapt, the likelihood is much higher that the provider can be a real partner in your organization’s cybersecurity efforts. Using OSINT or other less traditional collection methods to improve threat coverage is just one example of the kind of dynamic, adaptable threat intelligence vendor you should look for in sea of options now available in our industry’s market.

?