Domains

{
  "id": "ATTACK:enterprise:T1583.001",
  "title": "Domains",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1583/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--40f5caa0-4cb7-4117-89fc-d421bb493df3",
  "external_id": "T1583.001",
  "domain": "enterprise",
  "created": "2020-09-30T17:09:31.878Z",
  "modified": "2026-09-18T00:31:18.338Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "URI Unique",
      "url": "https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF"
    },
    {
      "source_name": "PaypalScam",
      "url": "https://www.zdnet.com/article/paypal-alert-beware-the-paypai-scam-5000109103/"
    },
    {
      "source_name": "CISA IDN ST05-016",
      "url": "https://us-cert.cisa.gov/ncas/tips/ST05-016"
    },
    {
      "source_name": "CISA MSS Sep 2020",
      "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-258a"
    },
    {
      "source_name": "bypass_webproxy_filtering",
      "url": "https://www.blackhillsinfosec.com/bypass-web-proxy-filtering/"
    },
    {
      "source_name": "FireEye APT28",
      "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
    },
    {
      "source_name": "Invictus IR DangerDev 2024",
      "url": "https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me"
    },
    {
      "source_name": "Domain_Steal_CC",
      "url": "https://krebsonsecurity.com/2018/11/that-domain-you-forgot-to-renew-yeah-its-now-stealing-credit-cards/"
    },
    {
      "source_name": "tt_obliqueRAT",
      "url": "https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"
    },
    {
      "source_name": "tt_httrack_fake_domains",
      "url": "https://blog.talosintelligence.com/2022/03/transparent-tribe-new-campaign.html"
    },
    {
      "source_name": "Mandiant APT1",
      "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
    },
    {
      "source_name": "Categorisation_not_boundary",
      "url": "https://www.mdsec.co.uk/2017/07/categorisation-is-not-a-security-boundary/"
    },
    {
      "source_name": "URI",
      "url": "https://www.techtarget.com/searchsecurity/tip/Preparing-for-uniform-resource-identifier-URI-exploits"
    },
    {
      "source_name": "Redirectors_Domain_Fronting",
      "url": "https://www.cobaltstrike.com/blog/high-reputation-redirectors-and-domain-fronting/"
    },
    {
      "source_name": "URI Use",
      "url": "https://www.blackhat.com/presentations/bh-dc-08/McFeters-Rios-Carter/Presentation/bh-dc-08-mcfeters-rios-carter.pdf"
    },
    {
      "source_name": "iOS URL Scheme",
      "url": "https://docs.ostorlab.co/kb/IPA_URL_SCHEME_HIJACKING/index.html"
    },
    {
      "source_name": "lazgroup_idn_phishing",
      "url": "https://web.archive.org/web/20171223000420/https://www.riskiq.com/blog/labs/lazarus-group-cryptocurrency/"
    },
    {
      "source_name": "httrack_unhcr",
      "url": "https://web.archive.org/web/20220527112908/https://www.riskiq.com/blog/labs/ukraine-malware-infrastructure/"
    },
    {
      "source_name": "ThreatConnect Infrastructure Dec 2020",
      "url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
    }
  ]
}