DomainTools | Black Hat Asia

📍 We’re in Singapore for #BHA2026!
Stop by DomainTools booth # 119 to see how our integrations reduce context-switching and identify evolving threats in real-time.
It's not too late to schedule a chat ➡️ https://www.domaintools.com/events/black-hat-asia
#BlackHatAsia #CyberSecurity

DomainTools Investigations | MOIS Linked MOIST GRASSHOPPER / Homeland Justice / KarmaBelow80 / Handala Hackers / Campaigns and Evolution Explore the evolution of MOIS-linked actors Homeland Justice, Karma, and Handala. Analysis of destructive malware, surveillance integration, and the 2026 Stryker incident.

New: The evolution of the MOIS-linked cyber ecosystem (Handala/Homeland Justice)
from the 2022 Albania attacks to the 2026 Stryker incident🛡️🇮🇷
Full investigation:dti.domaintools.com/research/mois-linked-moi...

DomainTools | Black Hat Asia

📍 Singapore bound for #BHA2026!
Stop by DomainTools booth # 119 to see how our integrations reduce context-switching and identify evolving threats in real-time.
Don't leave your 2026 strategy to chance. Schedule a chat➡️ https://www.domaintools.com/events/black-hat-asia
#BlackHatAsia #CyberSecurity

Fifteen (Newsletters) On A Skateboard - DomainTools Investigations | DTI DTI's March newsletter covers Doppelgänger disinformation infrastructure analysis, Cloudflare-abusing phishing campaigns, a TLS private key exposure in Qihoo 360's AI platform, and a malicious ChatGPT ad blocker Chrome extension stealing user conversations.

Spring is here in Seattle🌷, and the March DTI newsletter is live📰.
In this edition Daniel Schwalbe recaps a busy month of research, Ian Campbell's monthly reading list, and where to find us next! dti.domaintools.com/newsletters/fifteen-news...

Access DomainTools via the Model Context Protocol (MCP) 🌐

Connect your LLM or MCP enabled platform directly to our data to:
✅ Automate data retrieval and analysis
✅ Reduce context-switching
✅ Investigate at the speed of AI

Click here to learn more (https://www.domaintools.ai/mcp-access

DomainTools & Palo Alto Networks: Best in class DNS Intelligence Learn how DomainTools and Palo Alto Networks Cortex combine best-in-class DNS intelligence with automated playbooks and ML-powered risk scoring to help security teams detect, investigate, and respond to threats faster.

The most critical indicators, all in one place

New enhancements to the DomainTools App for Cortex by Palo Alto Networks deliver real-time streaming of critical intelligence feeds, providing seamless access to DomainTools data across Cortex.

Learn more: www.domaintools.com/blog/domaint...

DomainTools | Black Hat Asia

Want to see how the world's best CTI teams map adversary DNS? 🗺️
We’re heading to #BlackHatAsia 2026 to share how we provide 97% internet visibility and detection 10 days ahead of blocklists.
Let's grab coffee! Book 20 mins here ➡️ https://www.domaintools.com/events/black-hat-asia
#BHA2026 #OSINT

DomainTools Investigations | Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment Discover how Handala, Homeland Justice, and Karma function as a unified MOIS-linked cyber influence ecosystem. This threat intelligence assessment reveals how Iran uses "hack-and-leak" operations to weaponize perception over technical complexity.

DTI just released an analysis of activity attributed to Homeland Justice, Karma/KarmaBelow80, and Handala as a coordinated cyber influence ecosystem aligned with Iran’s MOIS.
Read more: dti.domaintools.com/research/handala-mois-li...

Integrating DomainTools into the AI-Powered SOC

Connecting your LLM to DomainTools is an instant force multiplier⚡
Get Domain intelligence directly in your chat interface. No context-switching - just natural language answers at the speed of AI.
Technical breakdown⬇️ www.domaintools.com/blog/integrating-domaint...

DomainTools Investigations | DPRK Malware Modularity: Diversity and Functional Specialization Explore the DPRK’s modular malware architecture. Analyze how North Korea uses compartmentalized toolchains for espionage, crypto theft, and strategic signaling.

🇰🇵Beyond the Fracture: DomainTools Investigations’ latest research analyzes the fragmented and parallel development pipelines behind North Korea’s specialized malware ecosystem.
Read the research here:dti.domaintools.com/research/dprk-malware-mo...

Our MCP server brings DomainTools to your LLM.
Investigation flow:
1️⃣ Prompt: “Look up [domain].”
2️⃣AI: Returns Risk Score & profile including IP
3️⃣Deep Dive: “What other domains are linked to this IP?”
4️⃣Result: Instant infrastructure map.
Request a demo now: https://www.domaintools.ai/mcp-access

At #FIC2026?🇫🇷 Don't miss our Principal Engineer Maxime Zielony's presentation tomorrow!

🎤 From Days to Seconds: The Evolution of Real-Time DNS Intelligence
📍 INCYBER Demos Stage, INCYBER Forum
🕒 Thursday, 02 April, 2026 2:00 PM to 2:30 PM · 30 min. (Europe/Paris)

We’re thrilled to announce our new MCP server, enabling you to access DomainTools intelligence directly within your AI workflows.

Learn more today: www.domaintools.com/press/domaintools-launch...

DomainTools | Black Hat Asia

Shift your posture from reactive to proactive at #BHA2026. 🇸🇬
With DomainTools, your team can:
✅ Automate the hunt
✅ Contextualize alerts
✅ Get more from your existing stack
Meet us in Singapore ➡️ https://www.domaintools.com/events/black-hat-asia
#BlackHatAsia #ThreatIntel

DomainTools Investigations | SecuritySnack - OpenAI Anti-Ads Malware Capitalizing on OpenAI's new ad policy, a malicious Chrome extension masked as a ChatGPT ad blocker was quietly stealing your conversations and sending them to a Discord channel.

This "ChatGPT Ad Blocker"🚧 extension is a data-harvesting tool.
It clones your ChatGPT conversations and sends them to a Discord webhook.
Learn more: dti.domaintools.com/securitysnacks/securitys...

#CyberSecurity #ChatGPT #DataPrivacy #Infosec

Planning your #FIC2026 schedule?

Stop by the DomainTools booth # G49 for a live demo and a quick conversation with our team.
We’re happy to meet over a coffee ☕nearby – or connect virtually if you can’t make it.

The DomainTools team is at #RSAC2026 holding meetings at Spaces. In case you missed it, you can still schedule a meeting with us at the link here: https://www.domaintools.com/events/rsac-2026

DomainTools | RSA Conference 2026

Make your security tools work smarter not harder. 🛠️ At #RSAC, we’re sharing how DomainTools data integrates with your SIEM, SOAR, and even LLM solutions to reduce cyber risk and boost efficiency.
Sign up to meet our product team ⬇️
https://www.domaintools.com/events/rsac-2026

DomainTools Investigations | Exposure of TLS Private Key for Myclaw 360 in Qihoo 360 “Security Claw” AI Platform DTI analysis of a leaked TLS private key from Qihoo 360's AI security platform, covering cryptographic validation, threat scenarios, and incident response.

🔑New from DTI: Technical breakdown of the TLS private key exposure for Qihoo 360’s "Security Claw" AI Platform.
Read more here: dti.domaintools.com/research/exposure-of-tls...
#CyberSecurity #ThreatIntel #AI #InfoSec

We’re looking forward to #FIC2026 and connecting with the security community.

At DomainTools, we’re focused on bringing Real-Time risk data into the tools teams already use – from SIEM/SOAR to emerging LLM security workflows.

Lets connect in Lille 👇
https://calendar.app.google/eNsysJgTdz7b4ab56

DomainTools | RSA Conference 2026

Heading to #RSAC 2026? 🌉 Let’s grab 10 minutes to discuss how our DNS infrastructure analysis keeps you ahead of the curve.
Book a coffee chat here ⬇️
https://www.domaintools.com/events/rsac-2026

DomainTools Investigations | SecuritySnack - CloudFlare Anti-Security For Phishing A Microsoft 365 credential harvesting campaign is exploiting CloudFlare's anti-bot and human verification features to evade detection. Learn how attackers use IP blocklists, user-agent filtering, and obfuscated scripts to bypass security scanners—and what it means for the industry.

New SecuritySnack: How attackers are abusing CloudFlare to hide M365 phishing campaigns. 🛡️➡️⚔️
Read the technical breakdown here: dti.domaintools.com/securitysnacks/securitys...
#CyberSecurity #Phishing #CloudSecurity #Infosec

We’re heading back to Lille for #FIC2026 🇫🇷

Catch us on April 2 at 2:00 PM to see how security teams are getting real-time insight into malicious infrastructure and staying ahead of attackers.

📅 Book time: https://calendar.app.google/eNsysJgTdz7b4ab56

DomainTools | RSA Conference 2026

Stop responding to threats and start predicting them. 🛑 Find us at #RSAC to see how our new Real-Time Threat Feeds can help you identify malicious infrastructure before it’s weaponized.

Schedule a meeting with the DomainTools team in SF ⬇️
https://www.domaintools.com/events/rsac-2026

Fourteen Newsletters and Fifteen Winters - DomainTools Investigations | DTI Learn how Lotus Blossom (G0030) weaponized Notepad++ updates. Plus, a deep dive into 250+ crypto scam domains and upcoming BSides San Francisco sessions.

One last February note 💌
The latest Daniel Schwalbe newsletter is here, featuring the DTI team’s latest analysis! Read it here👇 dti.domaintools.com/newsletters/fourteen-new...

DomainTools Investigations | Doppelgänger / RRN Disinformation Infrastructure Ecosystem 2026 Analysis of the Doppelgänger / RRN disinformation ecosystem. Learn how this DevOps-style infrastructure uses automated media impersonation, TLD rotation, and cloud-native hosting to target global audiences and evade enforcement.

📰DTI’s latest research dives into the dev-ops of disinformation campaigns. Read our investigation into the Doppelgänger / RRN disinformation ecosystem here 👇dti.domaintools.com/research/doppelganger-rr...
#Cybersecurity #Disinformation #InfoSec

DomainTools Investigations | SecuritySnack - Idolized Crypto Scams An analysis of an active cryptocurrency scam operation impersonating Trump, Musk, and Truth Social across 250+ domains — uncovering shared wallet infrastructure, on-chain laundering pipelines, and the tactics used to fake legitimacy.

From fake BTC “doublers” to wallet-draining presale sites, DTI uncovered a crypto scam network spanning ~250 domains impersonating public figures like Elon Musk and President Donald Trump.
Read the investigation ⬇️ dti.domaintools.com/securitysnac...
#Cybersecurity #Scams #Crypto #Infosec

🪷 The Petals of Espionage: DomainTools Investigations’ latest research analyzes the “who”, “how”, and “why” behind Lotus Blossom’s compromise of Notepad++.

Read the investigation: dti.domaintools.com/research/lotus-blossom-a...

It’s Day # 2 of #AFCEAWest, and DomainTools Federal is here at the San Diego Convention Center. Stop by Booth # 2309 to talk to our team about how we give you the offensive edge against state sponsored adversaries.

#CyberDefense #ThreatHunting #Federal #DomainTools

DomainTools Federal is at #AFCEAWest at the San Diego Convention Center! Stop by Booth # 2309 to learn how we’re giving bad actors more bad days.