CINXE.COM

<!DOCTYPE html> <html lang="en-US" class="html_stretched responsive av-preloader-disabled html_header_top html_logo_left html_main_nav_header html_menu_right html_slim html_header_sticky html_header_shrinking html_mobile_menu_tablet html_header_searchicon_disabled html_content_align_center html_header_unstick_top_disabled html_header_stretch html_minimal_header html_burger_menu html_av-overlay-side html_av-overlay-side-classic html_av-submenu-noclone html_entry_id_30810 av-cookies-no-cookie-consent av-no-preview av-default-lightbox html_burger_menu_active"> <head> <meta charset="UTF-8" />  <meta name="viewport" content="width=device-width, initial-scale=1">  <meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />  <title>Retail Targeted Campaigns—Domain Fraud, Brand Impersonation, and Ponzi Schemes, oh my! - DomainTools | Start Here. Know Now.</title> <link rel="preload" as="font" href="https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/domaintools-icons/domaintools-icons.woff2" crossorigin> <link rel="preload" as="font" href="https://www.domaintools.com/wp-content/plugins/enfold-fast/assets/fonts/fa-fontello.woff2" crossorigin><link rel="preload" data-rocket-preload as="image" href="https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero-300x169.jpg" media="(max-width: 767px)" fetchpriority="high"><link rel="preload" data-rocket-preload as="image" href="https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg" media="(min-width: 767.1px) and " fetchpriority="high"><link rel="preload" data-rocket-preload as="image" href="https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg" media="(min-width: 767.1px)" fetchpriority="high"> <meta name="description" content="DomainTools highlights several ways threat actors seek to take advantage of the retail cybersecurity landscape and aid in understanding how such activity can be enumerated and “clustered” to help organizations defend themselves." /> <link rel="canonical" href="https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/" /> <meta property="og:locale" content="en_US" /> <meta property="og:type" content="article" /> <meta property="og:title" content="Retail Targeted Campaigns—Domain Fraud, Brand Impersonation, and Ponzi Schemes, oh my! - DomainTools | Start Here. Know Now." /> <meta property="og:description" content="DomainTools highlights several ways threat actors seek to take advantage of the retail cybersecurity landscape and aid in understanding how such activity can be enumerated and “clustered” to help organizations defend themselves." /> <meta property="og:url" content="https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/" /> <meta property="og:site_name" content="DomainTools | Start Here. Know Now." /> <meta property="article:publisher" content="https://www.linkedin.com/company/domaintools/" /> <meta property="article:published_time" content="2024-09-10T15:49:23+00:00" /> <meta property="og:image" content="https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg" /> <meta property="og:image:width" content="1920" /> <meta property="og:image:height" content="1079" /> <meta property="og:image:type" content="image/jpeg" /> <meta name="author" content="DomainTools" /> <meta name="twitter:card" content="summary_large_image" /> <meta name="twitter:creator" content="@domaintools" /> <meta name="twitter:site" content="@domaintools" /> <meta name="twitter:label1" content="Written by" /> <meta name="twitter:data1" content="Kali Fencl" /> <script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"Article","@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/#article","isPartOf":{"@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/"},"author":{"name":"DomainTools","@id":"https://www.domaintools.com/#/schema/person/18e3f356410b35e564a8afae353f8027"},"headline":"Retail Targeted Campaigns—Domain Fraud, Brand Impersonation, and Ponzi Schemes, oh my!","datePublished":"2024-09-10T15:49:23+00:00","dateModified":"2024-09-10T15:49:23+00:00","mainEntityOfPage":{"@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/"},"wordCount":3256,"publisher":{"@id":"https://www.domaintools.com/#organization"},"image":{"@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/#primaryimage"},"thumbnailUrl":"https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg","keywords":["DomainTools Research"],"articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/","url":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/","name":"Retail Targeted Campaigns—Domain Fraud, Brand Impersonation, and Ponzi Schemes, oh my! - DomainTools | Start Here. Know Now.","isPartOf":{"@id":"https://www.domaintools.com/#website"},"primaryImageOfPage":{"@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/#primaryimage"},"image":{"@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/#primaryimage"},"thumbnailUrl":"https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg","datePublished":"2024-09-10T15:49:23+00:00","dateModified":"2024-09-10T15:49:23+00:00","description":"DomainTools highlights several ways threat actors seek to take advantage of the retail cybersecurity landscape and aid in understanding how such activity can be enumerated and “clustered” to help organizations defend themselves.","breadcrumb":{"@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/#primaryimage","url":"https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg","contentUrl":"https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg","width":1920,"height":1079},{"@type":"BreadcrumbList","@id":"https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.domaintools.com/home/"},{"@type":"ListItem","position":2,"name":"Retail Targeted Campaigns—Domain Fraud, Brand Impersonation, and Ponzi Schemes, oh my!"}]},{"@type":"WebSite","@id":"https://www.domaintools.com/#website","url":"https://www.domaintools.com/","name":"DomainTools | Start Here. Know Now.","description":"Start Here. Know Now.","publisher":{"@id":"https://www.domaintools.com/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://www.domaintools.com/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https://www.domaintools.com/#organization","name":"DomainTools","url":"https://www.domaintools.com/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://www.domaintools.com/#/schema/logo/image/","url":"https://www.domaintools.com/wp-content/uploads/DomainTools-Logo.svg","contentUrl":"https://www.domaintools.com/wp-content/uploads/DomainTools-Logo.svg","width":1,"height":1,"caption":"DomainTools"},"image":{"@id":"https://www.domaintools.com/#/schema/logo/image/"},"sameAs":["https://www.linkedin.com/company/domaintools/","https://x.com/domaintools"]},{"@type":"Person","@id":"https://www.domaintools.com/#/schema/person/18e3f356410b35e564a8afae353f8027","name":"DomainTools","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://www.domaintools.com/#/schema/person/image/","url":"https://secure.gravatar.com/avatar/28d4cbd1a3cb186c315213687baf728e?s=96&d=mm&r=g","contentUrl":"https://secure.gravatar.com/avatar/28d4cbd1a3cb186c315213687baf728e?s=96&d=mm&r=g","caption":"DomainTools"}}]}</script>  <link rel='dns-prefetch' href='//cdnjs.cloudflare.com' /> <link rel='dns-prefetch' href='//fonts.googleapis.com' /> <link href='https://fonts.gstatic.com' crossorigin rel='preconnect' /> <link rel="alternate" type="application/rss+xml" title="DomainTools | Start Here. Know Now. » Feed" href="https://www.domaintools.com/feed/" /> <link data-minify="1" rel='stylesheet' id='punch-core-gutenberg-css' href='https://www.domaintools.com/wp-content/cache/min/1/wp-content/plugins/punch-core/assets/css/gutenberg.css?ver=1731584871' type='text/css' media='all' /> <link rel='stylesheet' id='google-fonts-css' href='https://fonts.googleapis.com/css2?family=Outfit:wght@300;400;500;600;700&display=swap&text=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789.,!?;()%5B%5D®©' type='text/css' media='all' /> <link rel='stylesheet' id='source-code-pro-css' href='https://fonts.googleapis.com/css2?family=Source+Code+Pro:wght@400;500;600;700;800&display=swap&text=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789.,!?;()%5B%5D®©' type='text/css' media='all' /> <link data-minify="1" rel='stylesheet' id='avia-merged-styles-css' href='https://www.domaintools.com/wp-content/cache/min/1/wp-content/uploads/dynamic_avia/avia-merged-styles-dec8aee0c6471277385db06168dd2d59---673e1b6905a2d.css?ver=1732123497' type='text/css' media='all' /> <link data-minify="1" rel='stylesheet' id='theme-single-common-css' href='https://www.domaintools.com/wp-content/cache/min/1/wp-content/themes/domaintools/assets/css/single-common.css?ver=1731584849' type='text/css' media='all' /> <link data-minify="1" rel='stylesheet' id='theme-gutenberg-css' href='https://www.domaintools.com/wp-content/cache/min/1/wp-content/themes/domaintools/assets/css/gutenberg.css?ver=1731584868' type='text/css' media='all' /> <link data-minify="1" rel='stylesheet' id='prism-css-css' href='https://www.domaintools.com/wp-content/cache/min/1/ajax/libs/prism/9000.0.1/themes/prism.min.css?ver=1731584950' type='text/css' media='all' /> <script data-minify="1" type="text/javascript" src="https://www.domaintools.com/wp-content/cache/min/1/wp-content/plugins/punch-cookie-bar/cookiebar-latest.js?ver=1731579767" id="cookieBAR-js"></script> <script data-minify="1" type="text/javascript" src="https://www.domaintools.com/wp-content/cache/min/1/wp-content/uploads/dynamic_avia/avia-head-scripts-425689268445448da7b6c9d32a11126f---673e1b6933bfe.js?ver=1732123499" id="avia-head-scripts-js"></script> <link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://www.domaintools.com/xmlrpc.php?rsd" /> <link rel='shortlink' href='https://www.domaintools.com/?p=30810' /> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://www.domaintools.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.domaintools.com%2Fresources%2Fblog%2Fretail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes%2F" /> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://www.domaintools.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.domaintools.com%2Fresources%2Fblog%2Fretail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes%2F&format=xml" /> <style>.ep-lottie-loaded{opacity:1!important}</style> <noscript> <link data-minify="1" rel="stylesheet" href="https://www.domaintools.com/wp-content/cache/min/1/wp-content/plugins/enfold-fast/assets/css/dist/no-js.css?ver=1731579767"> </noscript> <script>document.addEventListener("DOMContentLoaded",function(){document.documentElement.style.setProperty("--scrollBarWidth",window.innerWidth-document.body.clientWidth+"px")});</script> <meta name="google-site-verification" content="qaSYWpiBBq9CONbTr_5X_iL9p3vOAVdcc5EWmVp3tig" />  <script data-minify="1" src="https://www.domaintools.com/wp-content/cache/min/1/js/forms2/js/forms2.min.js?ver=1731579768"></script>  <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-5P2JCN');</script>   <script> (function(){ var s = document.createElement('script'); var h = document.querySelector('head') || document.body; s.src = 'https://acsbapp.com/apps/app/dist/js/app.js'; s.async = true; s.onload = function(){ acsbJS.init({ statementLink : '', footerHtml : '', hideMobile : false, hideTrigger : false, disableBgProcess : false, language : 'en', position : 'left', leadColor : '#146ff8', triggerColor : '#146ff8', triggerRadius : '50%', triggerPositionX : 'left', triggerPositionY : 'bottom', triggerIcon : 'people', triggerSize : 'medium', triggerOffsetX : 20, triggerOffsetY : 20, mobile : { triggerSize : 'small', triggerPositionX : 'left', triggerPositionY : 'center', triggerOffsetX : 10, triggerOffsetY : 0, triggerRadius : '50%' } }); }; h.appendChild(s); })(); </script>   <meta name="google-site-verification" content="7VnyMZuPi9Rm0XuzoOnXS_TuAJ0oVeB7keYG35j2gDI" /> <meta name="google-site-verification" content="c3nGp1cI0hISCNSwnQdCH2Sg2vl8GYf3Xjf6c_xCQEo" />   <script type="text/javascript"> (function(c,l,a,r,i,t,y){ c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)}; t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i; y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y); })(window, document, "clarity", "script", "gv4l8utopq"); </script><link rel="profile" href="https://gmpg.org/xfn/11" /> <link rel="alternate" type="application/rss+xml" title="DomainTools | Start Here. Know Now. RSS2 Feed" href="https://www.domaintools.com/feed/" /> <link rel="pingback" href="https://www.domaintools.com/xmlrpc.php" />  <link rel="icon" href="/wp-content/uploads/DomainTools-Favicon.png" type="image/png"> <script> if( window.MSInputMethodContext && document.documentMode ){ document.write('<link data-minify="1" rel="stylesheet" href="https://www.domaintools.com/wp-content/cache/min/1/wp-content/themes/domaintools/assets/css/ie.css?ver=1731579767">'); } </script>  <script type="text/javascript">'use strict';var avia_is_mobile=!1;if(/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent)&&'ontouchstart' in document.documentElement){avia_is_mobile=!0;document.documentElement.className+=' avia_mobile '} else{document.documentElement.className+=' avia_desktop '};document.documentElement.className+=' js_active avia_transform avia_transform3d ';</script> <style type="text/css" id="wp-custom-css"> .gradient-dark-to-gray{ background: linear-gradient(180deg, rgba(27,31,41,1) 0%, rgba(116,133,157,1) 100%); } #top .shadow-font-family {h1, h2, h3, h4, h5, h6 .av-special-heading-tag{ font-family: "Shadows Into Light", cursive !important; } } .itemgrid--splunk-conf .ep-item-grid .ep-item-grid-item .ep-item-grid-item-inner{ @media only screen and (max-width: 989px) { display: inline-flex; flex-direction: column-reverse; } } .gradient-gray-to-dark{ background: linear-gradient(180deg, rgba(116,133,157,1) 0%, rgba(27,31,41,1) 100%); } .avia-builder-el-1, .avia-builder-el-2, .avia-builder-el-3, .avia-builder-el-4, .avia-builder-el-5{ opacity: 1 !important; animation: none !important; } .single-product .entry-content-wrapper ul li, .single-integration .entry-content-wrapper ul li { margin: 0.2em 0 !important; } #top .itemgrid--speaker .ep-item-grid-item-subtitle { font-size: 14px; color: #91D117; padding-bottom: 5px; } .has-inline-color a { color: inherit !important; } .hr:not(.hr-invisible) .hr-inner { background: var(--epBorderColor, #000) !important; } #top .itemgrid--simple-boxed.short-margin-bottom .ep-item-grid .ep-item-grid-item .ep-item-grid-item-inner { padding: 25px !important; margin-bottom: 20px; } #top .overflow-hidden{ overflow: hidden; } #top .has-circle-dots.position-dots-left:before{ right: 50%; left: auto; } .button--pill .avia-button { border-radius: 37px !important; } .button--pill .avia-button::before { border-radius: 37px !important; } .button--color-green .avia-button { border-color: #91D117 !important; color: #13161D !important; } .button--color-green .avia-button::before { background-color: #91D117 !important; } .itemgrid--post-black-hat .ep-item-grid-item-inner { background-color: #13161D; border-radius: 8px; padding: 10px 10px 20px 10px; height: 100%; } .itemgrid--post-black-hat .ep-item-grid-item-inner .ep-item-grid-content-wrapper { padding: 5px 20px; } .itemgrid--post-black-hat img { border-radius: 4px; } @media only screen and (max-width: 767px) { .balck-hat-breakpoint-bimg { background-image: none; background-color: #91D117; } } </style> <style type="text/css"> @font-face {font-family: 'fa-fontello'; font-weight: normal; font-style: normal; font-display: swap; src: url('https://www.domaintools.com/wp-content/plugins/enfold-fast/assets/fonts/fa-fontello.woff2') format('woff2'), url('https://www.domaintools.com/wp-content/plugins/enfold-fast/assets/fonts/fa-fontello.woff') format('woff'), url('https://www.domaintools.com/wp-content/plugins/enfold-fast/assets/fonts/fa-fontello.ttf') format('truetype'), url('https://www.domaintools.com/wp-content/plugins/enfold-fast/assets/fonts/fa-fontello.svg#fa-fontello') format('svg'), url('https://www.domaintools.com/wp-content/plugins/enfold-fast/assets/fonts/fa-fontello.eot'), url('https://www.domaintools.com/wp-content/plugins/enfold-fast/assets/fonts/fa-fontello.eot?#iefix') format('embedded-opentype'); } #top .avia-font-fa-fontello, body .avia-font-fa-fontello, html body [data-av_iconfont='fa-fontello']:before{ font-family: 'fa-fontello'; } @font-face {font-family: 'fontello'; font-weight: normal; font-style: normal; font-display: swap; src: url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/fontello/fontello.woff2') format('woff2'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/fontello/fontello.woff') format('woff'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/fontello/fontello.ttf') format('truetype'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/fontello/fontello.svg#fontello') format('svg'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/fontello/fontello.eot'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/fontello/fontello.eot?#iefix') format('embedded-opentype'); } #top .avia-font-fontello, body .avia-font-fontello, html body [data-av_iconfont='fontello']:before{ font-family: 'fontello'; } @font-face {font-family: 'domaintools-icons'; font-weight: normal; font-style: normal; font-display: swap; src: url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/domaintools-icons/domaintools-icons.woff2') format('woff2'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/domaintools-icons/domaintools-icons.woff') format('woff'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/domaintools-icons/domaintools-icons.ttf') format('truetype'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/domaintools-icons/domaintools-icons.svg#domaintools-icons') format('svg'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/domaintools-icons/domaintools-icons.eot'), url('https://www.domaintools.com/wp-content/uploads/dynamic_avia/avia_icon_fonts/domaintools-icons/domaintools-icons.eot?#iefix') format('embedded-opentype'); } #top .avia-font-domaintools-icons, body .avia-font-domaintools-icons, html body [data-av_iconfont='domaintools-icons']:before{ font-family: 'domaintools-icons'; } </style> <noscript><style id="rocket-lazyload-nojs-css">.rll-youtube-player, [data-lazy-src]{display:none !important;}</style></noscript> <style id="rocket-lazyrender-inline-css">[data-wpr-lazyrender] {content-visibility: auto;}</style><meta name="generator" content="WP Rocket 3.17.2.1" data-wpr-features="wpr_minify_js wpr_preload_fonts wpr_lazyload_iframes wpr_automatic_lazy_rendering wpr_oci wpr_image_dimensions wpr_minify_css wpr_desktop wpr_preload_links" /></head> <body id="top" class="post-template-default single single-post postid-30810 single-format-standard stretched rtl_columns av-curtain-numeric">  <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-5P2JCN" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>  <div id='wrap_all'> <div id="header" class="header " data-header-css="https://www.domaintools.com/wp-content/themes/domaintools/assets/css/header-lazy.css?62"> <div class="header-inner"> <div class="header-logo"> <a href="https://www.domaintools.com" class="logo" aria-label="DomainTools Logo"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1141.16 196.59"><defs><linearGradient id="A" x1="71.485" y1="117.001" x2="157.861" y2="56.975" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#99a8ba"/><stop offset=".19" stop-color="#b1bcca"/><stop offset=".55" stop-color="#dbe0e6"/><stop offset=".83" stop-color="#f5f6f8"/><stop offset="1" stop-color="#fff"/></linearGradient><linearGradient id="B" x1="103.172" y1="79.193" x2="97.069" y2="166.257" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#99a8ba"/><stop offset=".21" stop-color="#b4bfcc"/><stop offset=".56" stop-color="#dce1e7"/><stop offset=".83" stop-color="#f5f7f8"/><stop offset="1" stop-color="#fff"/></linearGradient><linearGradient id="C" x1="125.523" y1="105.551" x2="32.017" y2="72.413" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#99a8ba"/><stop offset="1" stop-color="#fff"/></linearGradient><path id="D" d="M442.06 81.17c-6.06-3.3-12.84-4.96-20.35-4.96s-14.57 1.68-20.58 5.03c-6.01 3.36-10.74 7.89-14.2 13.59-3.45 5.71-5.18 12.12-5.18 19.23s1.75 13.72 5.26 19.53c3.5 5.81 8.26 10.42 14.27 13.82 6.01 3.41 12.82 5.11 20.43 5.11s14.42-1.7 20.43-5.11c6.01-3.4 10.76-7.98 14.27-13.74 3.5-5.76 5.26-12.29 5.26-19.6s-1.75-13.54-5.26-19.3-8.29-10.29-14.35-13.59zm-6.01 42.13c-1.35 2.65-3.28 4.68-5.78 6.08s-5.36 2.1-8.56 2.1-6.06-.7-8.56-2.1-4.46-3.43-5.86-6.08-2.1-5.68-2.1-9.09c0-3.2.7-6.11 2.1-8.71s3.35-4.63 5.86-6.08c2.5-1.45 5.36-2.18 8.56-2.18s6.03.73 8.49 2.18c2.45 1.45 4.38 3.45 5.78 6.01 1.4 2.55 2.1 5.48 2.1 8.79s-.68 6.44-2.03 9.09z"/></defs><g fill="#fff"><path d="M359.2 59.64c-5.06-4.75-10.97-8.41-17.72-10.96-6.76-2.55-14.15-3.83-22.16-3.83h-42.66V150.9h42.96c7.91 0 15.25-1.3 22.01-3.91 6.76-2.6 12.64-6.28 17.65-11.04s8.91-10.36 11.72-16.82c2.8-6.46 4.21-13.54 4.21-21.26s-1.4-15.07-4.21-21.48c-2.8-6.41-6.74-11.99-11.79-16.75zm-12.39 55.43c-2.61 4.86-6.29 8.59-11.04 11.19-4.76 2.61-10.34 3.91-16.75 3.91h-18.63V65.58h18.63c6.31 0 11.84 1.28 16.6 3.83s8.46 6.26 11.12 11.12c2.65 4.86 3.98 10.59 3.98 17.2s-1.3 12.49-3.9 17.35z"/><use xlink:href="#D"/><path d="M1135.36,77.15c-2.55,0-4.63,2.08-4.63,4.63s2.08,4.63,4.63,4.63,4.63-2.08,4.63-4.63-2.08-4.63-4.63-4.63m0,10.43c-3.2,0-5.81-2.6-5.81-5.81s2.6-5.81,5.81-5.81,5.81,2.6,5.81,5.81-2.6,5.81-5.81,5.81"/><path d="M1134.38 82.39v2.3h-1.57v-6.08h2.39c.8 0 1.38.14 1.76.41.37.27.56.69.56 1.27 0 .4-.09.73-.29.99-.19.25-.48.45-.88.56.22.05.41.17.58.33s.34.43.51.79l.85 1.72h-1.67l-.74-1.51c-.15-.3-.3-.51-.46-.62-.15-.11-.36-.17-.61-.17h-.44zm.66-1.08c.32 0 .56-.06.7-.19.14-.12.22-.32.22-.6s-.08-.47-.22-.6c-.14-.12-.38-.17-.7-.17h-.66v1.56h.66zm-563.03-1.33c-4.41-2.35-9.36-3.53-14.87-3.53s-10.87 1.2-15.47 3.6a27.07 27.07 0 0 0-7.99 6.29c-2.1-2.62-4.61-4.77-7.55-6.44-4.06-2.3-8.59-3.45-13.59-3.45-5.51 0-10.39 1.13-14.65 3.38-1.9 1.01-3.62 2.21-5.18 3.6v-5.48h-23.13v73h23.13v-42.66c0-2.4.53-4.45 1.58-6.16a10.94 10.94 0 0 1 4.28-3.98c1.8-.95 3.85-1.43 6.16-1.43 3.3 0 6.08 1.03 8.34 3.08 2.25 2.05 3.38 4.88 3.38 8.49v42.66h23.13v-42.66c0-2.4.5-4.45 1.5-6.16 1-1.7 2.43-3.03 4.28-3.98s3.88-1.43 6.08-1.43c3.2 0 5.93 1.03 8.19 3.08 2.25 2.05 3.38 4.88 3.38 8.49v42.66h23.13v-45.36c0-6.11-1.25-11.32-3.75-15.62s-5.96-7.63-10.36-9.99zm76.9 3.86c-1.97-1.88-4.23-3.48-6.83-4.73-3.96-1.9-8.39-2.85-13.29-2.85-6.71 0-12.69 1.63-17.95 4.88s-9.41 7.76-12.47 13.52-4.58 12.29-4.58 19.6 1.53 13.8 4.58 19.45c3.05 5.66 7.23 10.16 12.54 13.52s11.27 5.03 17.87 5.03c5.01 0 9.49-.95 13.44-2.85 2.55-1.23 4.76-2.79 6.68-4.62v5.97h22.68v-73H648.9v6.08zm-3.53 42.73c-2.95 3.21-6.89 4.81-11.79 4.81-3.11 0-5.88-.73-8.34-2.18s-4.41-3.48-5.86-6.08-2.18-5.56-2.18-8.86.72-6.26 2.18-8.86c1.45-2.6 3.4-4.63 5.86-6.08 2.45-1.45 5.23-2.18 8.34-2.18s6.06.73 8.56 2.18 4.41 3.45 5.71 6.01c1.3 2.55 1.95 5.48 1.95 8.79 0 5.11-1.48 9.26-4.43 12.47zm52.35-84.04c-3.51 0-6.46 1.2-8.86 3.6s-3.6 5.41-3.6 9.01 1.2 6.51 3.6 9.01 5.36 3.75 8.86 3.75c3.7 0 6.68-1.25 8.94-3.75 2.25-2.5 3.38-5.51 3.38-9.01s-1.13-6.61-3.38-9.01-5.23-3.6-8.94-3.6zm-11.57 35.3h23.13v73h-23.13zm95.53 2.5c-4.21-2.5-8.96-3.76-14.27-3.76-5.61 0-10.64 1.18-15.1 3.53-2.03 1.07-3.85 2.35-5.48 3.83v-5.86h-23.13v73h23.13v-41.61c0-2.5.55-4.71 1.65-6.61s2.6-3.38 4.51-4.43c1.9-1.05 4.06-1.58 6.46-1.58 3.6 0 6.61 1.18 9.01 3.53s3.6 5.38 3.6 9.09v41.61h23.13v-46.71c0-5.01-1.2-9.64-3.6-13.89a27.16 27.16 0 0 0-9.91-10.14zm91.52-35.32h-90.13v20.73h33.2v85.32h23.88V65.74h33.05V45.01z"/><use xlink:href="#D" x="470.33" y="0.89"/><use xlink:href="#D" x="556.85" y="0.02"/><path d="M1026.84 41.72h23.13v109.05h-23.13zm60.43 53.89c1.3-.8 3.25-1.2 5.86-1.2s5.48.58 8.34 1.73c2.85 1.15 5.43 3.08 7.74 5.78l13.07-13.37c-3.21-4.2-7.46-7.38-12.77-9.54-5.31-2.15-11.02-3.23-17.12-3.23s-11.37 1-15.77 3c-4.41 2-7.81 4.73-10.21 8.19-2.4 3.45-3.6 7.54-3.6 12.24s.85 8.16 2.55 10.97c1.7 2.8 3.9 5.01 6.61 6.61 2.7 1.6 5.56 2.88 8.56 3.83s5.88 1.8 8.64 2.55c2.75.75 4.98 1.55 6.68 2.4s2.55 2.18 2.55 3.98c0 1.5-.73 2.65-2.18 3.45s-3.43 1.2-5.93 1.2c-4.01 0-7.64-.73-10.89-2.18-3.26-1.45-6.13-3.48-8.64-6.08l-13.22 13.22c2.6 2.7 5.66 5.08 9.16 7.14 3.5 2.05 7.36 3.66 11.57 4.81s8.46 1.73 12.77 1.73c9.11 0 16.35-2.13 21.71-6.38 5.36-4.26 8.04-9.94 8.04-17.05 0-4.6-.85-8.34-2.56-11.19-1.7-2.85-3.9-5.16-6.61-6.91-2.7-1.75-5.56-3.1-8.56-4.06-3-.95-5.83-1.78-8.49-2.48-2.65-.7-4.86-1.5-6.61-2.4s-2.63-2.1-2.63-3.6c0-1.3.65-2.35 1.95-3.15zm-895.79 20.72c-6.66-3.27-11.24-10.12-11.24-18.04s4.58-14.77 11.24-18.04c3.97-1.95 5.98-6.44 4.74-10.68-2.08-7.1-4.91-13.88-8.4-20.25-2.12-3.87-6.72-5.6-10.89-4.17-7.02 2.39-15.1.79-20.7-4.81s-7.2-13.68-4.81-20.7c1.42-4.17-.31-8.77-4.17-10.89-6.37-3.49-13.15-6.32-20.25-8.4-4.24-1.24-8.73.78-10.68 4.74-3.27 6.66-10.12 11.24-18.04 11.24S83.51 11.75 80.24 5.09C78.29 1.12 73.8-.89 69.56.35c-7.1 2.08-13.88 4.91-20.25 8.4-3.87 2.12-5.6 6.72-4.17 10.89 2.39 7.02.79 15.1-4.81 20.7s-13.68 7.2-20.7 4.81c-4.17-1.42-8.77.31-10.89 4.17-3.49 6.37-6.32 13.15-8.4 20.25-1.24 4.24.78 8.73 4.74 10.68 6.66 3.27 11.24 10.12 11.24 18.04s-4.58 14.77-11.24 18.04c-3.97 1.95-5.98 6.44-4.74 10.68 2.08 7.1 4.91 13.88 8.4 20.25 2.12 3.87 6.72 5.6 10.89 4.17 7.02-2.39 15.1-.79 20.7 4.81s7.2 13.68 4.81 20.7c-1.42 4.17.31 8.77 4.17 10.89 6.37 3.49 13.15 6.32 20.25 8.4 4.24 1.24 8.73-.78 10.68-4.74 3.27-6.66 10.12-11.24 18.04-11.24s14.77 4.58 18.04 11.24c1.95 3.97 6.44 5.98 10.68 4.74 7.1-2.08 13.88-4.91 20.25-8.4 3.87-2.12 5.6-6.72 4.17-10.89-2.39-7.02-.79-15.1 4.81-20.7s13.68-7.2 20.7-4.81c4.17 1.42 8.77-.31 10.89-4.17 3.49-6.37 6.32-13.15 8.4-20.25 1.24-4.24-.78-8.73-4.74-10.68zm-93.19 19.82c-20.91 0-37.86-16.95-37.86-37.86s16.95-37.86 37.86-37.86 37.86 16.95 37.86 37.86-16.95 37.86-37.86 37.86z"/></g><path d="M133.17 34.2a58.32 58.32 0 0 1 11.88 16.73c8.77 18.62 7.16 40.92-4.86 58.22-1.88 2.71-4 5.3-6.39 7.73a58.27 58.27 0 0 1-23.43 14.52 35.17 35.17 0 0 1-5.29 1.46c-11.01 2.13-22.84-1.01-31.43-9.47-8.62-8.49-11.94-20.33-9.93-31.41-1.9 8.9-1.77 18.37.82 27.74.91 3.29 2.09 6.42 3.5 9.4 8.97 19.06 27.48 31.6 47.99 33.32 6.69.56 13.58-.03 20.43-1.92 20.35-5.62 35.2-21.33 40.64-40.24.26-.93.51-1.86.73-2.79 6.48-26.96-.91-56.56-22.11-77.44-21.21-20.89-50.94-27.83-77.82-20.92 19.12-4.78 40.2.21 55.27 15.06z" fill="url(#A)"/><path d="M33.96 81.55c-3.83 5.51-6.77 11.78-8.55 18.65-5.21 20.03.64 40.33 13.74 54.47l1.7 1.76c.09.09.19.18.28.27.63.62 1.28 1.21 1.93 1.81 32.28 29.69 82.53 28.66 113.54-2.83 10.08-10.24 16.91-22.47 20.5-35.4-5.44 18.91-20.29 34.62-40.64 40.24-6.85 1.89-13.74 2.48-20.43 1.92-20.51-1.72-39.02-14.26-47.99-33.32-1.4-2.98-2.59-6.12-3.5-9.4a58.21 58.21 0 0 1-.82-27.74c.32-1.79.79-3.55 1.39-5.28 1.66-4.77 4.38-9.26 8.16-13.1 13.12-13.32 34.24-13.98 48.16-1.87A58.12 58.12 0 0 0 96.7 58.31c-3.3-.86-6.6-1.4-9.89-1.67-20.99-1.76-41.11 8-52.85 24.9z" fill="url(#B)"/><path d="M74.97 19.95c-12.8 3.8-24.85 10.79-34.88 20.98-31.07 31.54-31.28 81.91-.95 113.74-13.09-14.14-18.94-34.43-13.74-54.47 1.79-6.87 4.72-13.14 8.55-18.65 11.74-16.9 31.86-26.66 52.85-24.9 3.29.28 6.59.82 9.89 1.67a58.18 58.18 0 0 1 24.73 13.42 37.58 37.58 0 0 1 1.62 1.49c.59.58 1.14 1.18 1.68 1.78 12.15 13.74 11.77 34.73-1.3 48a35.02 35.02 0 0 1-13.06 8.39c8.59-2.81 16.66-7.64 23.43-14.52 2.39-2.43 4.51-5.02 6.39-7.73 12.02-17.3 13.62-39.6 4.86-58.22a58.32 58.32 0 0 0-11.88-16.73c-15.07-14.84-36.15-19.84-55.27-15.06a74.27 74.27 0 0 0-2.92.81z" fill="url(#C)"/></svg> </a> </div> <div class="header-menu"> <div class="menu-main-menu-large-b-dev-container"><ul id="menu-main-menu-large-b-dev" class="main-menu" role="menu"><li role="menuitem" id="menu-item-26387" class="products-menu menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-1"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Products</span></a> <div class='avia_mega_div avia_mega3 nine units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26388" class="menu-title menu-item menu-item-type-custom menu-item-object-custom avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'>Products</span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26389" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://domaintools.com/products/platform/'>Iris Intelligence Platform</a></span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26390" class="avia_mega_text_block menu-desc-bold menu-item menu-item-type-custom menu-item-object-custom">The first place to go when you need to know.</li> <li role="menuitem" id="menu-item-26395" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/platform/iris-investigate/" tabindex="0"><span class="avia-menu-text">Iris Investigate</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26396" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Map connected infrastructure to get ahead of threats.</li> </ul> </li> <li role="menuitem" id="menu-item-26391" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/platform/iris-detect/" tabindex="0"><span class="avia-menu-text">Iris Detect</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26392" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Discover and monitor lookalike domains with unmatched speed and coverage.</li> </ul> </li> <li role="menuitem" id="menu-item-26393" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/platform/iris-enrich/" tabindex="0"><span class="avia-menu-text">Iris Enrich</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26394" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Integrate DomainTools data with SIEM, SOAR, and other tools.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26405" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units "><span class='mega_menu_title heading-color av-special-font'><a href='/products/farsight-dnsdb/'>Farsight DNSDB</a></span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26406" class="avia_mega_text_block menu-desc-bold menu-item menu-item-type-custom menu-item-object-custom">The world’s largest Passive DNS intelligence solution.</li> <li role="menuitem" id="menu-item-26704" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/farsight-dnsdb/" tabindex="0"><span class="avia-menu-text">DNSDB API</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26701" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Unlock the power of 13+ years of historical passive DNS data, updated in real time.</li> </ul> </li> <li role="menuitem" id="menu-item-26705" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/farsight-dnsdb/" tabindex="0"><span class="avia-menu-text">DNSDB Export</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26702" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">The “on-premise” version of DNSDB API resulting in the fastest response time, unlimited query volume, and total query privacy.</li> </ul> </li> <li role="menuitem" id="menu-item-26706" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/farsight-dnsdb/" tabindex="0"><span class="avia-menu-text">DNSDB Flexible Search</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26703" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Regular expression search across every label of a fully qualified domain name and select RData.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26398" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_last"><span class='mega_menu_title heading-color av-special-font'><a href='/products/threat-intelligence-feeds/'>Threat Intelligence Feeds</a></span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26399" class="avia_mega_text_block menu-desc-bold menu-item menu-item-type-custom menu-item-object-custom">If it’s happening online, you’ll know.</li> <li role="menuitem" id="menu-item-26400" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/threat-intelligence-feeds/domain-visibility/" tabindex="0"><span class="avia-menu-text">Domain Visibility</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26401" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Daily risk-scored domain list and targeted feeds.</li> </ul> </li> <li role="menuitem" id="menu-item-26403" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/threat-intelligence-feeds/predictive-risk-scoring/" tabindex="0"><span class="avia-menu-text">Predictive Risk Score</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26404" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Predictive risk scoring and infrastructure profiling.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26407" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-2"><a href="https://www.domaintools.com/integrations/" tabindex="0"><span class="avia-menu-text">Integrations</span></a> <div class='avia_mega_div avia_mega2 six units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26452" class="menu-title menu-item menu-item-type-post_type menu-item-object-page avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://www.domaintools.com/integrations/'>Integrations</a></span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26453" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_first"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26454" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/integrations/?_integration=siem" tabindex="0"><span class="avia-menu-text">SIEM</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26455" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Enhance threat hunting and domain alerts in your preferred SIEM.</li> </ul> </li> <li role="menuitem" id="menu-item-26456" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/integrations/?_integration=soar" tabindex="0"><span class="avia-menu-text">SOAR</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26457" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Create event playbooks and take targeted action with our leading domain intelligence. </li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26458" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_last"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26460" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/integrations/?_integration=threat-intelligence" tabindex="0"><span class="avia-menu-text">Threat Intelligence</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26461" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Uncover actor infrastructure and profile threats in your preferred platform.</li> </ul> </li> <li role="menuitem" id="menu-item-26462" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/integrations/get-started/" tabindex="0"><span class="avia-menu-text">Getting Started</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26463" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Transform threat data into intelligence with top security vendor partnerships.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26408" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-3"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Partners</span></a> <div class='avia_mega_div avia_mega3 nine units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26409" class="menu-title menu-item menu-item-type-custom menu-item-object-custom avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'>Partners</span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26415" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_first"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26411" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/partners/resell-partner-program/" tabindex="0"><span class="avia-menu-text">Reseller Partner</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26412" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">VAR’s, Distributors, MSSP’s and System Integrators can grow revenue and improve margins.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26410" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units "> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26413" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/partners/oem-partners/" tabindex="0"><span class="avia-menu-text">OEM Partners</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26414" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Cyber Product and Service companies can quickly advance and differentiate your solution.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26443" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_last"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26416" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/partners/become-a-technology-partner/" tabindex="0"><span class="avia-menu-text">Technology Partners</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26417" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Cyber Technology Companies enhance and expand your capabilities.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26360" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-4"><a href="https://www.domaintools.com/solutions/" tabindex="0"><span class="avia-menu-text">Solutions</span></a> <div class='avia_mega_div avia_mega2 six units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26361" class="menu-title menu-item menu-item-type-post_type menu-item-object-page avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://www.domaintools.com/solutions/'>Solutions</a></span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26362" class="menu-subtitle two-column-li menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'>By Use Case</span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26363" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/threat-intelligence/" tabindex="0"><span class="avia-menu-text">Threat Intelligence</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26364" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">See the Internet. Identify risk.</li> </ul> </li> <li role="menuitem" id="menu-item-26365" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/phishing-fraud-prevention/" tabindex="0"><span class="avia-menu-text">Phishing and Fraud Prevention</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26366" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Gain the early upper hand on emerging campaigns.</li> </ul> </li> <li role="menuitem" id="menu-item-26367" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/threat-hunting/" tabindex="0"><span class="avia-menu-text">Threat Hunting</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26368" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Make unknown threats known before they do damage.</li> </ul> </li> <li role="menuitem" id="menu-item-26369" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/brand-protection/" tabindex="0"><span class="avia-menu-text">Brand Protection</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26370" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Defend your brand and reputation.</li> </ul> </li> <li role="menuitem" id="menu-item-26371" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/forensics-incident-response/" tabindex="0"><span class="avia-menu-text">Forensics & Incident Response</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26372" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Discover “who is” behind attacks and threats.</li> </ul> </li> <li role="menuitem" id="menu-item-26373" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/application-enrichment/" tabindex="0"><span class="avia-menu-text">Application Enrichment</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26374" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Build homegrown or third-party security applications with the world’s best Internet intelligence.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26444" class="menu-subtitle two-column-li menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_last"><span class='mega_menu_title heading-color av-special-font'>By Industry</span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26377" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/government/" tabindex="0"><span class="avia-menu-text">Federal Government</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26378" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Strengthening cybersecurity resilience across government systems.</li> </ul> </li> <li role="menuitem" id="menu-item-26379" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/financial-services/" tabindex="0"><span class="avia-menu-text">Financial Services</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26380" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Increasing the financial sector’s resilience against attacks.</li> </ul> </li> <li role="menuitem" id="menu-item-26381" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/healthcare/" tabindex="0"><span class="avia-menu-text">Healthcare</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26382" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Bolstering protection and defenses for PII and PHI.</li> </ul> </li> <li role="menuitem" id="menu-item-26383" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/technology/" tabindex="0"><span class="avia-menu-text">Technology</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26384" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Helping defenders of the high-tech attack surface.</li> </ul> </li> <li role="menuitem" id="menu-item-28315" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/retail/" tabindex="0"><span class="avia-menu-text">Retail</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-28318" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Safeguarding against data breaches, consumer-based attacks, phishing, BEC, and other threats.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26418" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-5"><a href="https://www.domaintools.com/company/" tabindex="0"><span class="avia-menu-text">Company</span></a> <div class='avia_mega_div avia_mega2 six units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26419" class="menu-title menu-item menu-item-type-post_type menu-item-object-page avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://www.domaintools.com/company/'>Company</a></span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26420" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_first"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26421" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/company/leadership/" tabindex="0"><span class="avia-menu-text">Leadership</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26422" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Meet our exceptional executive team of experts and industry leaders.</li> </ul> </li> <li role="menuitem" id="menu-item-26423" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/company/careers/" tabindex="0"><span class="avia-menu-text">Careers</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26424" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Join our team to collaborate with exceptional people who are dedicated to protecting the Internet.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26425" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_last"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26426" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/company/press/" tabindex="0"><span class="avia-menu-text">Pressroom</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26427" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Access the latest DomainTools news and press coverage.</li> </ul> </li> <li role="menuitem" id="menu-item-26428" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/contact/" tabindex="0"><span class="avia-menu-text">Contact</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26429" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">We’re here to help with product info, pricing, and current and future account services.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26430" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-6"><a href="https://www.domaintools.com/resources/" tabindex="0"><span class="avia-menu-text">Resource Center</span></a> <div class='avia_mega_div avia_mega3 nine units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26431" class="menu-title menu-item menu-item-type-post_type menu-item-object-page avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://www.domaintools.com/resources/'>Resource Center</a></span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26432" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_first"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26433" class="menu-subtitle one-column-li menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Knowledge Center</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26434" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent menu-item-has-children"><a href="https://www.domaintools.com/resources/blog/" tabindex="0"><span class="avia-menu-text">Blog</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26445" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Explore our library of thought leadership articles and insights.</li> </ul> </li> <li role="menuitem" id="menu-item-26435" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children"><a href="https://www.domaintools.com/resources/webinars/" tabindex="0"><span class="avia-menu-text">Webinars</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26446" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Watch live and on-demand cybersecurity training from the DomainTools team.</li> </ul> </li> <li role="menuitem" id="menu-item-26436" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children"><a href="https://www.domaintools.com/resources/podcasts/" tabindex="0"><span class="avia-menu-text">Podcasts</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26447" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Stream informative and exclusive episodes of DomainTools “Breaking Badness” podcast.</li> </ul> </li> <li role="menuitem" id="menu-item-26437" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children"><a href="https://www.domaintools.com/resources/white-papers/" tabindex="0"><span class="avia-menu-text">White Papers</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26448" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Discover the real-world impact of DomainTools DNS intelligence.</li> </ul> </li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26450" class="menu-subtitle one-column-li menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units "><span class='mega_menu_title heading-color av-special-font'>Client Resources</span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26438" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children"><a href="https://www.domaintools.com/resources/user-guides/" tabindex="0"><span class="avia-menu-text">User Guides</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26449" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Navigate DomainTools features effortlessly with our comprehensive guides.</li> </ul> </li> <li role="menuitem" id="menu-item-26439" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/resources/api-documentation/" tabindex="0"><span class="avia-menu-text">API Documentation</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26451" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Access everything you need, including endpoint, response formats, sample queries, and product service levels.</li> </ul> </li> <li role="menuitem" id="menu-item-26440" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/support/" tabindex="0"><span class="avia-menu-text">Customer FAQs</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26441" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Explore our in-depth Frequently Asked Questions by category to get the answers you need.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26442" class="menu-featured-post menu-item menu-item-type-custom menu-item-object-custom avia_mega_menu_columns_3 three units avia_mega_menu_columns_last"> <div class="mega-menu-featured-post-section"> <div class="mega-menu-featured-post-wrapper"> <div class="mega-menu-featured-post-wrapper-inner"> <div class="mega-menu-featured-tag">Featured</div> <div class="mega-menu-featured-post-category"> <span class='ep-item-term ep-item-term-blog' style='--termColor: #4c68fd' >Blog</span> </div> <div class="mega-menu-featured-post-title"> <a href="https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/" > Retail Targeted Campaigns—Domain Fraud, Brand Impersonation, and Ponzi Schemes, oh my! </a> </div> </div> <div class="mega-menu-featured-post-button"> <a href="https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/" class="avia-button avia-color-underline">Read More</a> </div> </div> </div> </li> </ul> </div> </li> </ul></div> </div> <div class="header-secondary-menu">  <div class="menu-secondary-menu-container"><ul id="menu-secondary-menu" class="secondary-menu" role="menu"><li role="menuitem" id="menu-item-28626" class="menu-search menu-item menu-item-type-custom menu-item-object-custom menu-item-top-level menu-item-top-level-1"><a href="/?s" tabindex="0"><span class="avia-menu-text">-</span></a></li> <li role="menuitem" id="menu-item-11673" class="menu-help menu-item menu-item-type-post_type menu-item-object-page menu-item-top-level menu-item-top-level-2"><a href="https://www.domaintools.com/support/" tabindex="0"><span class="avia-menu-text">Support and Learning</span></a></li> <li role="menuitem" id="menu-item-6664" class="menu-login menu-item menu-item-type-custom menu-item-object-custom menu-item-top-level menu-item-top-level-3"><a target="_blank" href="https://research.domaintools.com/" tabindex="0" rel="noopener"><span class="avia-menu-text">-</span></a></li> <li role="menuitem" id="menu-item-11653" class="menu-demo menu-item menu-item-type-post_type menu-item-object-page menu-item-top-level menu-item-top-level-4"><a href="https://www.domaintools.com/demo/" tabindex="0"><span class="avia-menu-text">Request a Demo</span></a></li> </ul></div> </div> <button class="hamburger-toggle" aria-label="Mobile Menu Toggle"> <div class="burger-box"></div> </button> </div> <div class="hamburger-overlay"></div> <div class="hamburger-content"> <div class="hamburger-content-inner"> <div class="menu-main-menu-large-b-dev-container"><ul id="menu-main-menu-large-b-dev-1" class="main-menu" role="menu"><li role="menuitem" id="menu-item-26387" class="products-menu menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-7"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Products</span></a> <div class='avia_mega_div avia_mega3 nine units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26388" class="menu-title menu-item menu-item-type-custom menu-item-object-custom avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'>Products</span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26389" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://domaintools.com/products/platform/'>Iris Intelligence Platform</a></span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26390" class="avia_mega_text_block menu-desc-bold menu-item menu-item-type-custom menu-item-object-custom">The first place to go when you need to know.</li> <li role="menuitem" id="menu-item-26395" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/platform/iris-investigate/" tabindex="0"><span class="avia-menu-text">Iris Investigate</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26396" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Map connected infrastructure to get ahead of threats.</li> </ul> </li> <li role="menuitem" id="menu-item-26391" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/platform/iris-detect/" tabindex="0"><span class="avia-menu-text">Iris Detect</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26392" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Discover and monitor lookalike domains with unmatched speed and coverage.</li> </ul> </li> <li role="menuitem" id="menu-item-26393" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/platform/iris-enrich/" tabindex="0"><span class="avia-menu-text">Iris Enrich</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26394" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Integrate DomainTools data with SIEM, SOAR, and other tools.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26405" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units "><span class='mega_menu_title heading-color av-special-font'><a href='/products/farsight-dnsdb/'>Farsight DNSDB</a></span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26406" class="avia_mega_text_block menu-desc-bold menu-item menu-item-type-custom menu-item-object-custom">The world’s largest Passive DNS intelligence solution.</li> <li role="menuitem" id="menu-item-26704" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/farsight-dnsdb/" tabindex="0"><span class="avia-menu-text">DNSDB API</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26701" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Unlock the power of 13+ years of historical passive DNS data, updated in real time.</li> </ul> </li> <li role="menuitem" id="menu-item-26705" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/farsight-dnsdb/" tabindex="0"><span class="avia-menu-text">DNSDB Export</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26702" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">The “on-premise” version of DNSDB API resulting in the fastest response time, unlimited query volume, and total query privacy.</li> </ul> </li> <li role="menuitem" id="menu-item-26706" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/farsight-dnsdb/" tabindex="0"><span class="avia-menu-text">DNSDB Flexible Search</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26703" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Regular expression search across every label of a fully qualified domain name and select RData.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26398" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_last"><span class='mega_menu_title heading-color av-special-font'><a href='/products/threat-intelligence-feeds/'>Threat Intelligence Feeds</a></span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26399" class="avia_mega_text_block menu-desc-bold menu-item menu-item-type-custom menu-item-object-custom">If it’s happening online, you’ll know.</li> <li role="menuitem" id="menu-item-26400" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/threat-intelligence-feeds/domain-visibility/" tabindex="0"><span class="avia-menu-text">Domain Visibility</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26401" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Daily risk-scored domain list and targeted feeds.</li> </ul> </li> <li role="menuitem" id="menu-item-26403" class="black-menu-title menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/products/threat-intelligence-feeds/predictive-risk-scoring/" tabindex="0"><span class="avia-menu-text">Predictive Risk Score</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26404" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Predictive risk scoring and infrastructure profiling.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26407" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-8"><a href="https://www.domaintools.com/integrations/" tabindex="0"><span class="avia-menu-text">Integrations</span></a> <div class='avia_mega_div avia_mega2 six units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26452" class="menu-title menu-item menu-item-type-post_type menu-item-object-page avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://www.domaintools.com/integrations/'>Integrations</a></span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26453" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_first"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26454" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/integrations/?_integration=siem" tabindex="0"><span class="avia-menu-text">SIEM</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26455" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Enhance threat hunting and domain alerts in your preferred SIEM.</li> </ul> </li> <li role="menuitem" id="menu-item-26456" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/integrations/?_integration=soar" tabindex="0"><span class="avia-menu-text">SOAR</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26457" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Create event playbooks and take targeted action with our leading domain intelligence. </li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26458" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_last"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26460" class="menu-subtitle menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="/integrations/?_integration=threat-intelligence" tabindex="0"><span class="avia-menu-text">Threat Intelligence</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26461" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Uncover actor infrastructure and profile threats in your preferred platform.</li> </ul> </li> <li role="menuitem" id="menu-item-26462" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/integrations/get-started/" tabindex="0"><span class="avia-menu-text">Getting Started</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26463" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Transform threat data into intelligence with top security vendor partnerships.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26408" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-9"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Partners</span></a> <div class='avia_mega_div avia_mega3 nine units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26409" class="menu-title menu-item menu-item-type-custom menu-item-object-custom avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'>Partners</span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26415" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_first"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26411" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/partners/resell-partner-program/" tabindex="0"><span class="avia-menu-text">Reseller Partner</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26412" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">VAR’s, Distributors, MSSP’s and System Integrators can grow revenue and improve margins.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26410" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units "> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26413" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/partners/oem-partners/" tabindex="0"><span class="avia-menu-text">OEM Partners</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26414" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Cyber Product and Service companies can quickly advance and differentiate your solution.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26443" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_last"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26416" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/partners/become-a-technology-partner/" tabindex="0"><span class="avia-menu-text">Technology Partners</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26417" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Cyber Technology Companies enhance and expand your capabilities.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26360" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-10"><a href="https://www.domaintools.com/solutions/" tabindex="0"><span class="avia-menu-text">Solutions</span></a> <div class='avia_mega_div avia_mega2 six units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26361" class="menu-title menu-item menu-item-type-post_type menu-item-object-page avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://www.domaintools.com/solutions/'>Solutions</a></span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26362" class="menu-subtitle two-column-li menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'>By Use Case</span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26363" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/threat-intelligence/" tabindex="0"><span class="avia-menu-text">Threat Intelligence</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26364" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">See the Internet. Identify risk.</li> </ul> </li> <li role="menuitem" id="menu-item-26365" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/phishing-fraud-prevention/" tabindex="0"><span class="avia-menu-text">Phishing and Fraud Prevention</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26366" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Gain the early upper hand on emerging campaigns.</li> </ul> </li> <li role="menuitem" id="menu-item-26367" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/threat-hunting/" tabindex="0"><span class="avia-menu-text">Threat Hunting</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26368" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Make unknown threats known before they do damage.</li> </ul> </li> <li role="menuitem" id="menu-item-26369" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/brand-protection/" tabindex="0"><span class="avia-menu-text">Brand Protection</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26370" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Defend your brand and reputation.</li> </ul> </li> <li role="menuitem" id="menu-item-26371" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/forensics-incident-response/" tabindex="0"><span class="avia-menu-text">Forensics & Incident Response</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26372" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Discover “who is” behind attacks and threats.</li> </ul> </li> <li role="menuitem" id="menu-item-26373" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/use-cases/application-enrichment/" tabindex="0"><span class="avia-menu-text">Application Enrichment</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26374" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Build homegrown or third-party security applications with the world’s best Internet intelligence.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26444" class="menu-subtitle two-column-li menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_last"><span class='mega_menu_title heading-color av-special-font'>By Industry</span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26377" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/government/" tabindex="0"><span class="avia-menu-text">Federal Government</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26378" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Strengthening cybersecurity resilience across government systems.</li> </ul> </li> <li role="menuitem" id="menu-item-26379" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/financial-services/" tabindex="0"><span class="avia-menu-text">Financial Services</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26380" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Increasing the financial sector’s resilience against attacks.</li> </ul> </li> <li role="menuitem" id="menu-item-26381" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/healthcare/" tabindex="0"><span class="avia-menu-text">Healthcare</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26382" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Bolstering protection and defenses for PII and PHI.</li> </ul> </li> <li role="menuitem" id="menu-item-26383" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/technology/" tabindex="0"><span class="avia-menu-text">Technology</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26384" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Helping defenders of the high-tech attack surface.</li> </ul> </li> <li role="menuitem" id="menu-item-28315" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/solutions/industry/retail/" tabindex="0"><span class="avia-menu-text">Retail</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-28318" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Safeguarding against data breaches, consumer-based attacks, phishing, BEC, and other threats.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26418" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-11"><a href="https://www.domaintools.com/company/" tabindex="0"><span class="avia-menu-text">Company</span></a> <div class='avia_mega_div avia_mega2 six units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26419" class="menu-title menu-item menu-item-type-post_type menu-item-object-page avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://www.domaintools.com/company/'>Company</a></span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26420" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_first"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26421" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/company/leadership/" tabindex="0"><span class="avia-menu-text">Leadership</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26422" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Meet our exceptional executive team of experts and industry leaders.</li> </ul> </li> <li role="menuitem" id="menu-item-26423" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/company/careers/" tabindex="0"><span class="avia-menu-text">Careers</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26424" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Join our team to collaborate with exceptional people who are dedicated to protecting the Internet.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26425" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_2 three units avia_mega_menu_columns_last"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26426" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/company/press/" tabindex="0"><span class="avia-menu-text">Pressroom</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26427" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Access the latest DomainTools news and press coverage.</li> </ul> </li> <li role="menuitem" id="menu-item-26428" class="menu-subtitle menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/contact/" tabindex="0"><span class="avia-menu-text">Contact</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26429" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">We’re here to help with product info, pricing, and current and future account services.</li> </ul> </li> </ul> </li> </ul> </div> </li> <li role="menuitem" id="menu-item-26430" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-mega-parent menu-item-top-level menu-item-top-level-12"><a href="https://www.domaintools.com/resources/" tabindex="0"><span class="avia-menu-text">Resource Center</span></a> <div class='avia_mega_div avia_mega3 nine units'> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26431" class="menu-title menu-item menu-item-type-post_type menu-item-object-page avia_mega_menu_columns_1 three units avia_mega_menu_columns_last avia_mega_menu_columns_first"><span class='mega_menu_title heading-color av-special-font'><a href='https://www.domaintools.com/resources/'>Resource Center</a></span></li> </ul><ul role="menu" class="sub-menu avia_mega_hr"> <li role="menuitem" id="menu-item-26432" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units avia_mega_menu_columns_first"> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26433" class="menu-subtitle one-column-li menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Knowledge Center</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26434" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent menu-item-has-children"><a href="https://www.domaintools.com/resources/blog/" tabindex="0"><span class="avia-menu-text">Blog</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26445" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Explore our library of thought leadership articles and insights.</li> </ul> </li> <li role="menuitem" id="menu-item-26435" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children"><a href="https://www.domaintools.com/resources/webinars/" tabindex="0"><span class="avia-menu-text">Webinars</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26446" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Watch live and on-demand cybersecurity training from the DomainTools team.</li> </ul> </li> <li role="menuitem" id="menu-item-26436" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children"><a href="https://www.domaintools.com/resources/podcasts/" tabindex="0"><span class="avia-menu-text">Podcasts</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26447" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Stream informative and exclusive episodes of DomainTools “Breaking Badness” podcast.</li> </ul> </li> <li role="menuitem" id="menu-item-26437" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children"><a href="https://www.domaintools.com/resources/white-papers/" tabindex="0"><span class="avia-menu-text">White Papers</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26448" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Discover the real-world impact of DomainTools DNS intelligence.</li> </ul> </li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26450" class="menu-subtitle one-column-li menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children avia_mega_menu_columns_3 three units "><span class='mega_menu_title heading-color av-special-font'>Client Resources</span> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26438" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children"><a href="https://www.domaintools.com/resources/user-guides/" tabindex="0"><span class="avia-menu-text">User Guides</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26449" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Navigate DomainTools features effortlessly with our comprehensive guides.</li> </ul> </li> <li role="menuitem" id="menu-item-26439" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/resources/api-documentation/" tabindex="0"><span class="avia-menu-text">API Documentation</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26451" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Access everything you need, including endpoint, response formats, sample queries, and product service levels.</li> </ul> </li> <li role="menuitem" id="menu-item-26440" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/support/" tabindex="0"><span class="avia-menu-text">Customer FAQs</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-26441" class="avia_mega_text_block menu-item menu-item-type-custom menu-item-object-custom">Explore our in-depth Frequently Asked Questions by category to get the answers you need.</li> </ul> </li> </ul> </li> <li role="menuitem" id="menu-item-26442" class="menu-featured-post menu-item menu-item-type-custom menu-item-object-custom avia_mega_menu_columns_3 three units avia_mega_menu_columns_last"> <div class="mega-menu-featured-post-section"> <div class="mega-menu-featured-post-wrapper"> <div class="mega-menu-featured-post-wrapper-inner"> <div class="mega-menu-featured-tag">Featured</div> <div class="mega-menu-featured-post-category"> <span class='ep-item-term ep-item-term-blog' style='--termColor: #4c68fd' >Blog</span> </div> <div class="mega-menu-featured-post-title"> <a href="https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/" > Retail Targeted Campaigns—Domain Fraud, Brand Impersonation, and Ponzi Schemes, oh my! </a> </div> </div> <div class="mega-menu-featured-post-button"> <a href="https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/" class="avia-button avia-color-underline">Read More</a> </div> </div> </div> </li> </ul> </div> </li> </ul></div> <div class="menu-secondary-menu-container"><ul id="menu-secondary-menu-1" class="secondary-menu" role="menu"><li role="menuitem" id="menu-item-28626" class="menu-search menu-item menu-item-type-custom menu-item-object-custom menu-item-top-level menu-item-top-level-5"><a href="/?s" tabindex="0"><span class="avia-menu-text">-</span></a></li> <li role="menuitem" id="menu-item-11673" class="menu-help menu-item menu-item-type-post_type menu-item-object-page menu-item-top-level menu-item-top-level-6"><a href="https://www.domaintools.com/support/" tabindex="0"><span class="avia-menu-text">Support and Learning</span></a></li> <li role="menuitem" id="menu-item-6664" class="menu-login menu-item menu-item-type-custom menu-item-object-custom menu-item-top-level menu-item-top-level-7"><a target="_blank" href="https://research.domaintools.com/" tabindex="0" rel="noopener"><span class="avia-menu-text">-</span></a></li> <li role="menuitem" id="menu-item-11653" class="menu-demo menu-item menu-item-type-post_type menu-item-object-page menu-item-top-level menu-item-top-level-8"><a href="https://www.domaintools.com/demo/" tabindex="0"><span class="avia-menu-text">Request a Demo</span></a></li> </ul></div> </div> </div> </div> <div id='main' class='all_colors' data-scroll-offset='88'> <div class="single-content-section avia-section alternate_color avia-section-large avia-no-border-styling avia-builder-el-0 el_before_av_section avia-builder-el-first container_wrap fullsize has-sidebar"> <div class="single-post-hero-img"> <div class="single-post-hero-img-inner"> <picture> <source media='(max-width: 767px)' srcset='https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero-300x169.jpg'> <source srcset='https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg'> <img fetchpriority="high" width="1920" height="1079" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Clustering-Retail-Threat-Actors-Blog-Hero.jpg" class="avia-img-lazy-loading-30829 attachment-full size-full" alt="" loading="lazy" decoding="async" /> </picture> </div> </div> <div class="container"> <div class="content"> <div class="entry-content-wrapper"> <div class="hero-content-wrapper"> <div class="post-data-wrapper"> <a class='ep-item-term ep-item-term-blog' href='https://www.domaintools.com/resources/blog/' style='--termColor: #4c68fd' >Blog</a> <a class='ep-item-term ep-item-term-domaintools-research' href='https://www.domaintools.com/resources/tag/domaintools-research/'>DomainTools Research</a> </div> <h1 class="entry-title">Retail Targeted Campaigns—Domain Fraud, Brand Impersonation, and Ponzi Schemes, oh my!</h1> <div class="post-share-wrapper"> <div class="post-date">09/10/2024</div> <div class="post-share"><div class="av-share-box"><h5 class='av-share-link-description av-no-toc '>Share this entry</h5><ul class="av-share-box-list noLightbox"><li class='av-share-link av-social-link-facebook' ><a target="_blank" aria-label="Share on Facebook" href='https://www.facebook.com/sharer.php?u=https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/&t=Retail%20Targeted%20Campaigns%E2%80%94Domain%20Fraud%2C%20Brand%20Impersonation%2C%20and%20Ponzi%20Schemes%2C%20oh%20my%21' aria-hidden='false' data-av_icon='' data-av_iconfont='fa-fontello' title='' data-avia-related-tooltip='Share on Facebook' rel="noopener"><span class='avia_hidden_link_text'>Share on Facebook</span></a></li><li class='av-share-link av-social-link-twitter' ><a target="_blank" aria-label="Share on Twitter" href='https://twitter.com/share?text=Retail%20Targeted%20Campaigns%E2%80%94Domain%20Fraud%2C%20Brand%20Impersonation%2C%20and%20Ponzi%20Schemes%2C%20oh%20my%21&url=https://www.domaintools.com/?p=30810' aria-hidden='false' data-av_icon='' data-av_iconfont='fa-fontello' title='' data-avia-related-tooltip='Share on Twitter' rel="noopener"><span class='avia_hidden_link_text'>Share on Twitter</span></a></li><li class='av-share-link av-social-link-linkedin' ><a target="_blank" aria-label="Share on Linkedin" href='https://linkedin.com/shareArticle?mini=true&title=Retail%20Targeted%20Campaigns%E2%80%94Domain%20Fraud%2C%20Brand%20Impersonation%2C%20and%20Ponzi%20Schemes%2C%20oh%20my%21&url=https://www.domaintools.com/resources/blog/retail-targeted-campaigns-domain-fraud-brand-impersonation-and-ponzi-schemes/' aria-hidden='false' data-av_icon='' data-av_iconfont='fa-fontello' title='' data-avia-related-tooltip='Share on Linkedin' rel="noopener"><span class='avia_hidden_link_text'>Share on Linkedin</span></a></li><li class='av-share-link av-social-link-mail' ><a aria-label="Share by Mail" href="/cdn-cgi/l/email-protection#e0df9395828a858394ddb2859481898cc5d2d0b481928785948584c5d2d0a3818d908189878e93c5a5d2c5d8d0c5d9d4a48f8d81898ec5d2d0a692819584c5d2a3c5d2d0a292818e84c5d2d0a98d908592938f8e8194898f8ec5d2a3c5d2d0818e84c5d2d0b08f8e9a89c5d2d0b38388858d8593c5d2a3c5d2d08f88c5d2d08d99c5d2d1c6c3d0d3d8db828f8499dd8894949093dacfcf979797ce848f8d81898e948f8f8c93ce838f8dcf9285938f9592838593cf828c8f87cf92859481898ccd9481928785948584cd83818d908189878e93cd848f8d81898ecd8692819584cd8292818e84cd898d908592938f8e8194898f8ecd818e84cd908f8e9a89cd938388858d8593cf" aria-hidden='false' data-av_icon='' data-av_iconfont='fa-fontello' title='' data-avia-related-tooltip='Share by Mail'><span class='avia_hidden_link_text'>Share by Mail</span></a></li></ul></div></div> </div> <div class="post-author-wrapper"> <div class="post-author"> <div class="post-author-image"> <a href="https://www.domaintools.com/authors/domaintools-research/"> <img width="800" height="800" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Favicon.png" class="attachment-full size-full" alt="DomainTools Favicon" decoding="async" fetchpriority="high" /> </a> </div> <div class="post-author-name"> <a href="https://www.domaintools.com/authors/domaintools-research/" class="author-name"> DomainTools Research </a> <a target="_blank" rel="nofollow" href="https://twitter.com/SecuritySnacks" class="author-link">@SecuritySnacks</a> </div> </div> </div> </div> <div class="content-with-sidebar-wrapper"> <div class="content-left"> <h2 class="wp-block-heading">Threat Actors Shopping Around Domain Fraud, Brand Impersonation, and Ponzi Schemes </h2> <p>It’s hard to overstate the significance of the retail sector on a global level; it’s a driver of countless types of economic activity. Shipping and transportation, manufacturing, technology, commercial real estate, finance, and so many other sectors benefit from the flow of goods and services it generates. Estimated to be over $30 trillion globally annually, the top 50 retailers alone generated over $1.13 trillion in revenue in 2023.</p> <p>From the most significant global corporations to the neighborhood corner stores and millions of online shops, the sector’s scope and diversity are truly enormous.</p> <p>Given the volumes of goods and services and their monetary value, the retail sector is no stranger to the subjects of fraud, theft, and other types of crime. Threat actors have always been and continue to actively engage in efforts to benefit from the value the industry creates illicitly. Beyond the monetary losses, this drives the impact on an organization’s brand, and the relationship with their consumer is equally important. The threat landscape has expanded as the industry has sought to embrace new online models for reaching consumers globally.</p> <p>This blog highlights several ways that actors seek to take advantage of this growing landscape and aid in understanding how such activity can be enumerated and “clustered” to help organizations defend themselves. As such, we will dig into three different “clusters” affecting the retail sector.</p> <h2 class="wp-block-heading">Cluster One – E-commerce Domain Fraud</h2> <p>As the retail sector sought to respond to the challenges brought on by the global pandemic and transition even more fully to e-commerce solutions, threat actors also adapted their tactics. While many retailers managed this transition, the impact on others led to an increase in the closure of physical storefronts and, in turn, an increase from threat actors in “outlet store” and “store closing” types of fraud. Trying to lure victims with the promise of significant discounts, one threat actor group stood up hundreds of websites seeking to impersonate dozens of global retailers and consumer brands. Let’s look into what this group did in more detail.</p> <p>As shown in Figure 1, screenshots in DomainTools <a href="https://www.domaintools.com/products/platform/iris-investigate/">Iris Investigate</a> show happed[.]shop impersonated multiple brands over short periods of time, often changing between victims in a matter of days or weeks. This was only one of several domains used in the campaign.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1000" height="225" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-WholeSale.jpg" alt="" class="wp-image-30813"/></figure> <figure class="wp-block-image size-full is-resized"><img decoding="async" width="1000" height="242" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Target.jpg" alt="" class="wp-image-30812" style="width:800px;height:auto"/></figure> <figure class="wp-block-image size-full"><img decoding="async" width="1000" height="365" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-GameStop.jpg" alt="" class="wp-image-30811"/><figcaption class="wp-element-caption">Figure 1: Images of three retailers impersonated over a short period of time. Note the templated layout across the top of the three images.</figcaption></figure> <p></p> <p>To facilitate the impersonation of so many brands, the actor relied on templates which provide defenders an additional method of enumerating potentially offending domains. The actor was consistent in their use of certain domain registrars, common name servers, and services like Cloudflare in order to manage and obfuscate their campaigns. This fingerprint combination allowed for the identification of hundreds of additional domains. </p> <p>The use of templates and redirecting domains to each other also afforded opportunities to identify missteps in their campaigns. One such domain that appeared in numerous templates related to other brands was nordstrom-rack-dream[.]com which was found on a template that was related to discountedca[.]com. By examining redirections, we discovered additional IP addresses, including 3.33.208[.]165 and 15.197.242[.]87. Viewing passive DNS results uncovered close to 5,000 additional domains impacting dozens of other brands.</p> <p>The actors would often repurpose a domain and use it to abuse many different brands often within days of each other. The domain we covered in <a href="https://www.domaintools.com/resources/blog/we-need-an-american-girl-who-bolsters-cybersecurity/">our blog about usgirlshop[.]com</a> is just one example about how using all parts of the Whois record and searching through Iris for historical screenshots opened up significant new avenues for investigation. The domain registration details included a very unique address from which to pivot off of. This address was associated with five other domains including one that impersonated Steve Madden shoes and another that sought to represent American Threads, a popular clothing retailer. To use “usgirl” as an example, just 8 days before targeting American Girl, it was impersonating a furniture retailer as seen here, and another domain that featured the furniture retailer went on to impersonate yet another shoe retailer, as shown in Figure 2.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1000" height="365" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-2.jpg" alt="" class="wp-image-30814"/><figcaption class="wp-element-caption">Figure 2: Screenshots of additional brands impersonated via usgirlshop[.]com before it was used to impersonate American Girl.</figcaption></figure> <p></p> <p>What was consistent amongst the thousands of domains were the website templates used. Understanding the potential source of the template was important in fingerprinting domains that cluster together. Thankfully the TLS/SSL cert data related to a number of domains provided a key piece of intelligence. Given the scale at which this actor group operates, they tended to reuse TLS/SSL certs. Running across individual certs that had 40 or 50 domains was not unusual. One certificate stood out head and shoulders above the others, with over 2,300 domains associated with it. Looking at the cert data there was a domain associated with it that was unlike the domains associated with brand impersonations. Reviewing that domain revealed the source of the templates used in so many attacks. The actors were abusing a legitimate e-commerce platform designed and intended for legitimate brands and companies to launch their own online stores. The threat actor generated thousands of landing pages for their malicious domain registrations using an automated process from a number of potential templates. The abuse of the platform also provided a key insight into Facebook and other ads that promoted the fraudulent domains to potential victims. The actors took advantage of marketing tools meant for legitimate purposes to further drive traffic to these sites through the integrations offered by the platform.</p> <p>Using the fingerprint of registrar preference, Cloudflare service, and template image, along with their preference for TLDs like .shop, .store, and .com, we could finally see the full extent of their campaigns see Figure 3. The toll in domains, as mentioned previously, is in the thousands over the past three years alone, and impacted hundreds of brands, including the largest global retailers, luxury brands like Rolex and Cartier, telecommunications providers, clothing stores, and yes, even American Girl.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1000" height="663" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-3.jpg" alt="" class="wp-image-30815"/><figcaption class="wp-element-caption">Figure 3: A visualization of the domains and IPs used by this threat actor to target the retail sector. Shoutout to our friends at Maltego for the use of their tooling integrated with DomainTools data.</figcaption></figure> <h2 class="wp-block-heading"><strong>Cluster Two – Brand Impersonation for Financial Fraud</strong></h2> <p>The Internet has enabled many people to make money working remotely. Unfortunately, bad actors have also leveraged the notion of “side hustles” to enrich themselves with schemes to lure individuals looking for extra income. Promised payments for completing tasks or recruiting others are two examples of how actors try and leverage their activities by preying on both sides of the economic spectrum. They do this by using brand reputation and goodwill associated with well-known retailers to conduct financial fraud. </p> <p>This activity cluster started with amazon-9000[.]com, which we found in February 2024, via an <a href="https://www.domaintools.com/products/platform/iris-detect/">Iris Detect</a> alert using the term “Amazon” as a trigger for new domain registrations. The domain was privacy-protected and used Cloudflare to obfuscate the IP that it resolved to. Undeterred, we pivoted on the Google Analytics code associated with the website. The code revealed over two hundred other domains. Upon examination, an overwhelming number related to Amazon including, amazon-300[.]com, amazon-2000[.]com and many others following similar registration conventions. Reviewing the domains and screenshots associated with them revealed a common set of landing pages, a few of which are shown in Figure 4.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1390" height="334" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-4.jpg" alt="" class="wp-image-30818"/><figcaption class="wp-element-caption">Figure 4: Screenshots from domains found from pivoting off of amazon-9000[.]com. While many were Amazon-related, not all of them were. Also note the prominent “Recharge,” “Withdrawal,” and “Invite” buttons which are central to this scheme.</figcaption></figure> <p>The copy text in Figure 4 reads: “Welcome to the Amazon platform! As long as you have a mobile phone or computer, you can join our work anytime, anywhere, and the operation is simple. Match task orders through the Amazon platform intelligent system every day to help merchants increase sales and word of mouth, complete task orders to get corresponding principal + commission, and easily earn high remuneration.” </p> <p>We used <a href="https://urlscan.io/" target="_blank" rel="noreferrer noopener">URLScan</a> to look closer at amazon-9000[.]com. The HTTP requests revealed one file that caught our eye, “Calculate-revenue.png.” This file called out to 107.148.90[.]74, which in turn was hosting other Amazon spoof domains, including amazon-labor[.]com. The scope of the investigation quickly expanded to include “awsa” as an Amazon-related theme, and it went on to include many other brands including, Allegro, Target, Lazada, Ebay, NewEgg, Aliexpress, TikTok, and Walmart. Naming conventions for all these brand domains closely followed those first observed with Amazon (i.e. using numbers) and the templated screenshots. </p> <p>One specific example highlighted in Figure 5 is of a Lazada domain which shared similarities with both the Amazon and Target domains. Beyond the shared naming convention islazada-111[.]com, we found the TLS/SSL certificate associated with it (with a hash of 8965ad719ebeffc18718656d965f389d43627f6e), included 18 other Lazada-themed domains. This pivot via a shared certificate was a trait we more broadly found, a certificate to link domains affecting a single brand.</p> <figure class="wp-block-image size-full"><img decoding="async" width="662" height="506" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-5.jpg" alt="" class="wp-image-30819"/><figcaption class="wp-element-caption">Figure 5: A screenshot from islazada-111[.]com, pretending to be Lazada as part of this campaign. Note the template similarities to the screenshots in Figure 4.</figcaption></figure> <p></p> <p>There is also a Telegram logo in the right corner of each screenshot, labeled “Service.” It links to Telegram channels named to be associated with the brand they are impersonating. The shift to Telegram allows the actors to further communicate with prospective victims and interview them about country of origin and other questions. It’s also used to attempt to explain what the “platform” is and how they supposedly support the aims and business units of the brand they are impersonating. Figure 6 shows a screenshot of an interaction with one such channel.</p> <figure class="wp-block-image size-full"><img decoding="async" width="602" height="616" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-6.jpg" alt="" class="wp-image-30820"/><figcaption class="wp-element-caption">Figure 6: Part of a “FAQ” provided during a conversation over a Telegram channel. This form of interactivity allows the bad actors to reinforce multiple aspects of the scheme with victims.</figcaption></figure> <p></p> <p>Once a victim has registered, they are informed that they must “invest” USDT (“Tether”) cryptocurrency with the group in order to receive tasks and the associated “commissions” that go with them. Starting at $20 in USDT and scaling up to $1,000 USDT, commission rates jump with promised returns of up to $20,000 USDT. Beyond the “<a href="https://www.domaintools.com/resources/blog/no-blocking-no-issue-the-curious-ecosystem-of-financial-advisor-impersonation-scams/">pig butchering</a>” aspect of this offer with the promise of enormous gains, there is a heavy emphasis on a second facet of their scheme to encourage the user to recruit others. The actors provide the victim with what might seem like a multi-level marketing opportunity, but would be more accurately characterized as what it is: a Ponzi scheme.</p> <p>To get a better understanding of the infrastructure related to this operation, we reviewed the passive DNS records of the additional brand domains uncovered through the HTTP requests. While many resolved to Cloudflare IPs from the start, there are a number that didn’t. One IP 165.154.162[.]145 almost exclusively hosts the domains related to Target, and where every domain illustrates the reuse of SSL certificates amongst smaller subsets of the domains in question. Figure 7 shows a <a href="https://www.maltego.com/" target="_blank" rel="noreferrer noopener">Maltego</a> visualization of some of the infrastructure used in the campaign.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1000" height="570" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-7.jpg" alt="" class="wp-image-30821"/><figcaption class="wp-element-caption">Figure 7: Four loosely coupled clusters of domains, each one spoofing one retail brand. They are all interconnected to the central cluster thanks to the specific pivots we were able to uncover.</figcaption></figure> <p></p> <p>An additional pivot off the website title data reveals a plethora of other related domains: </p> <pre class="wp-block-code"><code>balancegc[.]xyz,httpwwww[.]org,primevideo[.]cyou,secureredeem[.]com,target-6[.]com,targetgrow[.]com,targetpublicizing[.]com,targetmarket[.]cc,targetpublicizing[.]com,teragat[.]com,tgmall118[.]com,tragat[.]net,tragtmall[.]vip,workingtarget[.]cc,wwwhttps[.]cyou,wwws[.]live,wwwhttps[.]cyou,krogerr[.]vip,tarrget[.]shop,tgmall128[.]com,tarrgetmarket[.]shop,tarrgetmraket[.]shop,targetmall[.]cc,targetmarkets888[.]shop,targetmarkets888[.]top,targetmraket[.]cc,targetsol[.]online,tgmall126[.]com,traget[.]shop,emagshop[.]top,targetmarkest[.]shop,targetniokv[.]org,tarrgetmarket[.]cc,targetmraket[.]vip,tarrgetmraket[.]cc,tgmall119[.]com,yjjef[.]com,traget[.]cc,target-001[.]com,targetmarkets[.]top,yfjer[.]com,yuyyj[.]com,tragetmarkte[.]cc,waytotarget[.]com,starbucksgiftscardbalance[.]com,waytotarget[.]vip,limango[.]top,target58[.]com,target58[.]vip,target-8[.]com,targetpiggybank[.]ru,target-002[.]com,target-40[.]com,target-80[.]com,targetbbs[.]com,target-7[.]com,target-15[.]com,target2earn[.]com,tmarketshop[.]vip,targetsmarket[.]club,targetmarket[.]club,targetimprove[.]com,targetmarket[.]vip,targetmarkets[.]shop,targetmarkets[.]vip,omarovdidar[.]kz,tmarketshop[.]cc,digitalsecure[.]shop,logiria[.]com,target-50000[.]com,targetshop[.]online,target-30[.]com,target-60[.]com,target-70[.]com,target-20[.]com,target-1007[.]com,target-55555[.]com,targetmarkets[.]cc,target-19[.]com,target-108[.]com,target-90[.]com,target33[.]com,burazlegabracika[.]com,target-567[.]com,target4digital[.]com[.]br,target-883[.]com,targetksa[.]com,gelaundry[.]shop,zvamp[.]com,targetservices[.]co,targettours[.]in</code></pre> <p>While the owner of the IP was listed as UCloud USA with Los Angeles, California as its location, all abuse and contact information list UCloud addresses in Hong Kong, and .cn domains for their contact emails.</p> <p>To understand more we returned to the HTTP requests again and found this interesting request tied to the domains: [“http://103.106.202.53:10086/income_app/income_update.php”, “http://bigw123.com/income_app/income_update.php”]. It produced an additional IP 103.106.202[.]53, and the domain bigw123[.]com. The domain had resolved to that IP address ever so briefly back in August of 2020, so we decided to enter the IP into VirusTotal to see what other files might have been associated with it. Of the 13 referring files one stood out as being flagged as malicious significantly more than the others. Most recently submitted in mid-March, it tied back to the same domain via the request in the site, and included calls to another domain: freecitph[.]com. </p> <p>While the domain is inactive as of the time of writing, a few quick OSINT reviews and Google queries shed light on why that is likely the case. There are numerous articles, YouTube videos, and a long list of posts from affected people around the world referencing “freecit” and its connections to crypto and many other related scams including the Ponzi scheme uncovered during the course of this investigation. While data and infrastructure can definitively tie together and expose the malicious schemes of threat actors and the brands they victimize, that same infrastructure empowered countless people to step forward and bravely share their experiences and losses to assist others from facing that same fate. They, too, stepped up to ensure that more bad actors have more bad days.</p> <h2 class="wp-block-heading">Cluster Three – Success Sadly Has a Thousand Cousins</h2> <p>Within criminal forums, actors not only trade in stolen data, credit cards, and other items but also trade knowledge and sell countless tutorials on how others can do the same. Actors brazenly market these schemes using a host of social media and messaging platforms. When a fraudulent activity finds success, it’s quickly replicated. This is our third cluster of malicious activity against the Retail sector—a copycat of the second cluster above.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1014" height="350" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-8.jpg" alt="" class="wp-image-30822"/><figcaption class="wp-element-caption">Figure 8: Screenshot from targetpk8[.]top impersonating Target.</figcaption></figure> <p></p> <p>In this investigation, an Iris Detect alert based on the term “target” produced a domain registered in late 2023, targetpk8[.]top. Like others we have seen, it is privacy-protected and uses Cloudflare. A screenshot of the domain in Figure 8 shows that it is intended to fraudulently represent Target Corp. as a retailer. </p> <p>While the domain, Whois, and IP addresses pose a challenge, we again look to other pivots available when conducting an investigation. In this case, the TLS/SSL certificate shows a number of other domains associated with the same cert. While targetpk7[.]top and the original domain share the same hash, the alternative names listed broaden our search, including targetaa1[.]com, targetdd1[.]com, tgtacting[.]com, and tgtacting[.]vip. A review of these domains shows the same panel for each of them. The naming convention for the series seems to suggest that there could possibly be more registrations like them. A quick advanced search in Iris returns even more domains very similar to what we’ve previously seen:</p> <pre class="wp-block-code"><code>target7a[.]win,target7b[.]win,target8[.]win,target9[.]win,targetkk88[.]com,targetpp22[.]com,targetpk7[.]top,targetpk8[.]top,targetaa1[.]com,targetdd1[.]com</code></pre> <p>The .vip domain is also an example of the additional intel that screenshots can provide. Often assets are hosted on different IP addresses than the listed A record, and in this case the screen capture is a wealth of new information in the form of its configuration details, as shown in Figure 9.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1210" height="632" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-9.jpg" alt="" class="wp-image-30823"/><figcaption class="wp-element-caption">Figure 9: Screenshot of PHP-related configuration information found when browsing around tgtacting[.]vip which links it directly to targetpk8[.]top and shopre3[.]vip</figcaption></figure> <p></p> <p>The information collected in the image reveals the connection to targetpk8[.]top and goes on to provide additional information in regard to additional IPs and another domain shopre3[.]vip–a domain submitted to Google Safe Browsing only five months after being registered. Before warming to visitors, shopre3 hosted a familiar panel, this time impacting a large Asian Ecommerce company Daraz, which is owned by Alibaba.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1624" height="630" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-10.jpg" alt="" class="wp-image-30824"/><figcaption class="wp-element-caption">Figure 10: historical screenshot from shopre3[.]vip targeting Daraz. Note the same template as FIgure 8.</figcaption></figure> <p></p> <p>We decided to run a similar process to see if there were domains that might warrant further investigation into this brand, as cybercriminals tend to repeat behaviors in their domain registrations.. Sure enough, domains showing similar naming conventions, TLS/SSL certificate reuse, and website titles appeared and provided more avenues of investigation regarding the actor group and an initial foothold. Additional domains include:</p> <pre class="wp-block-code"><code> 2daraz[.]com,darazpk[.]vip,1daraz[.]com,souq618[.]com,arazpk[.]vip,khobornao[.]online,samalsbp06[.]cc,1daraz[.]com,mercadolibre07[.]com,1mercadolibre[.]com,darazz8[.]top,ayaatus[.]shop,darazaz[.]top,darazz8[.]com,clicktoocart[.]com,dhongtrendy[.]shop,fashionus[.]shop,darazaz[.]com,beautifullifelogisticserviceltd[.]online </code></pre> <p>As this process was repeated, new brands and impacted companies were discovered, including Walmart, Shopify, Amazon, and more. For the sake of brevity, we included a <a href="https://github.com/DomainTools/SecuritySnacks/blob/main/2024/Retail%20Targeted%20Campaigns/retail_targeted_campaign_domains.csv" target="_blank" rel="noreferrer noopener">list of additional domains as an appendix to the blog</a>. </p> <p>The visualization of this cluster is tighter than that of the previous campaign.  As shown in Figure 11, the domains all clustered around a set of IP addresses and TLS/SSL hashes, regardless of the brand they were spoofing.</p> <figure class="wp-block-image size-full"><img decoding="async" width="1000" height="542" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Figure-11.jpg" alt="" class="wp-image-30825"/><figcaption class="wp-element-caption">Figure 11: Visualization of the domains in this campaign, with a notably different clustering than Figure 7, suggesting a different threat actor is using the same Ponzi scheme idea</figcaption></figure> <p></p> <p>While similar in nature to the previous cluster in its attempts to fraudulently co-opt the brand value and goodwill of large retailers, the process of defrauding victims was more closely aligned with a conventional or traditional Ponzi scheme. No attempt was made to lure people with the false promise of commissions.They instead focused on the speculation in crypto markets and played up the fear of missing out on the next big “overnight” crypto windfall by soliciting victims for modest “investments” at the start. </p> <p>Like many Ponzi schemes, initial returns were provided to victims in an effort to extract even larger investments from the victim and to induce them to recruit others before pulling the rug out from under them. Because this scam was initially promoted on social media and advertising, it has been overcome to some extent by awareness raised by numerous individuals and other online outlets that focus on customer fraud. As with similar types of schemes, continued diligence and monitoring of threat actor infrastructure helps to blunt the damage of their actions while efforts in pursuing legal remedies for their disruption make their way through the justice system.</p> <h2 class="wp-block-heading">Conclusion</h2> <p>As these clusters indicate, the retail sector faces not only the broader threats that businesses more generally face such as ransomware, phishing, and business email compromise (BEC), but unique threats that try to leverage the brand loyalty and the relationship these brands have with their customers. Bad actors may look to use the brand goodwill to sell knockoff goods at steep discounts, defraud victims by stealing banking or other personal information, or even use the brand to convince victims into participating in cryptocurrency-themed Ponzi schemes.</p> <p>Given the breadth of the infrastructure and domains employed by these actor groups, along with the rate of recidivism they have displayed, it’s imperative for retail brands to maintain regular watch over their activities. The actor groups’ activities go back as far as September of 2020, and so it is clear that they will not likely abandon their campaigns against the retail sector, but will pivot amongst victims and continue to inflict harm on both the brands and their consumers.</p> <p>Because of this, protecting the broader retail sector against these diverse challenges requires not only the monitoring of actor activity and infrastructure, but the ability to share intelligence with other organizations to help augment and build on the sector’s collective defense. Like other sectors, industry ISACs play a valuable role. <a href="https://rhisac.org/" target="_blank" rel="noreferrer noopener">The Retail and Hospitality ISAC</a> (RH-ISAC) and organizations like <a href="https://www.ncfta.net/" target="_blank" rel="noreferrer noopener">The National Cyber-Forensics and Training Alliance</a> (NCFTA) are a tremendous resource for the retail sector, fostering that collective effort and allowing organizations to benefit from and contribute to shared intelligence and defense. As these examples have shown, threat actors rarely only focus on one organization, and intelligence and data that helps protect one brand can be used to benefit others. Working together helps to ensure that more bad actors have more bad days.</p> <div class="wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex"> <div class="wp-block-button"><a class="wp-block-button__link wp-element-button" href="https://github.com/DomainTools/SecuritySnacks/blob/main/2024/Retail%20Targeted%20Campaigns/retail_targeted_campaign_domains.csv">View List of Domains on GitHub</a></div> </div> <p></p> <p></p> </div> <div class="sidebar"> <div class="inner-sidebar"> <div class='sidebar-related-posts style-box'> <div class="h5 related-posts-heading">Related Posts</div> <div class='ep-posts-grid-container ep-grid-wrapper ' ><div class='ep-posts-grid ep-grid columns is-multiline is-mobile is-variable '><div class="ep-item-grid-item ep-posts-grid-item ep-post-grid-item column is-full-mobile is-full-tablet is-full-desktop entry-common entry-29233 entry-post " > <div class="ep-item-grid-item-inner column-inner"> <div class="ep-item-grid-item-media"> <div class="ep-item-grid-image"> <a class='noHover' href='https://www.domaintools.com/resources/blog/we-need-an-american-girl-who-bolsters-cybersecurity/' > <img width="700" height="418" src="https://www.domaintools.com/wp-content/uploads/we-need-an-american-girl-who-bolsters-cybersecurity-featured-post-image.jpg" class="avia-img-lazy-loading-29238 attachment-post-thumbnail size-post-thumbnail" alt="Abstract digital artwork showing interconnected lines and dots forming a colorful geometric mesh on a dark blue background." loading="lazy" decoding="async" /> </a> </div> </div> <div class="ep-item-grid-content-wrapper"> <div class="ep-item-grid-item-title-wrapper"> <span class='ep-item-term ep-item-term-blog' style='--termColor: #4c68fd' >Blog</span> <h4 class="ep-item-grid-item-title" > <a class='noHover' href='https://www.domaintools.com/resources/blog/we-need-an-american-girl-who-bolsters-cybersecurity/' > We need an American Girl who bolsters cybersecurity </a> </h4> </div> <div class="ep-item-grid-item-button-wrapper"> <a href="https://www.domaintools.com/resources/blog/we-need-an-american-girl-who-bolsters-cybersecurity/" class="avia-button avia-color-underline avia-size-medium"> <span class="avia_iconbox_title">Read more</span> </a> </div> </div> </div> </div> <div class="ep-item-grid-item ep-posts-grid-item ep-post-grid-item column is-full-mobile is-full-tablet is-full-desktop entry-common entry-28977 entry-post " > <div class="ep-item-grid-item-inner column-inner"> <div class="ep-item-grid-item-media"> <div class="ep-item-grid-image"> <a class='noHover' href='https://www.domaintools.com/resources/blog/what-did-we-learn-from-the-2023-holiday-season/' > <img width="700" height="418" src="https://www.domaintools.com/wp-content/uploads/what-did-we-learn-from-the-2023-holiday-season-featured-post-image.jpg" class="avia-img-lazy-loading-28983 attachment-post-thumbnail size-post-thumbnail" alt="Abstract image depicting a network of interconnected nodes and lines in a web-like structure, glowing in blue on a dark background, symbolizing digital or technological connectivity from the lessons of the 2023 Holiday Season" loading="lazy" decoding="async" /> </a> </div> </div> <div class="ep-item-grid-content-wrapper"> <div class="ep-item-grid-item-title-wrapper"> <span class='ep-item-term ep-item-term-blog' style='--termColor: #4c68fd' >Blog</span> <h4 class="ep-item-grid-item-title" > <a class='noHover' href='https://www.domaintools.com/resources/blog/what-did-we-learn-from-the-2023-holiday-season/' > What Did We Learn from the 2023 Holiday Season? </a> </h4> </div> <div class="ep-item-grid-item-button-wrapper"> <a href="https://www.domaintools.com/resources/blog/what-did-we-learn-from-the-2023-holiday-season/" class="avia-button avia-color-underline avia-size-medium"> <span class="avia_iconbox_title">Read more</span> </a> </div> </div> </div> </div> <div class="ep-item-grid-item ep-posts-grid-item ep-post-grid-item column is-full-mobile is-full-tablet is-full-desktop entry-common entry-28226 entry-post " > <div class="ep-item-grid-item-inner column-inner"> <div class="ep-item-grid-item-media"> <div class="ep-item-grid-image"> <a class='noHover' href='https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Best-Practices-Guide.pdf' > <img width="2560" height="1439" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Services-Best-Practices-Guide.jpg" class="avia-img-lazy-loading-28241 attachment-post-thumbnail size-post-thumbnail" alt="An abstract network visualization with interconnected lines and nodes on a dark background. nodes are colored differently, with one prominent orange and another green." loading="lazy" decoding="async" /> </a> </div> </div> <div class="ep-item-grid-content-wrapper"> <div class="ep-item-grid-item-title-wrapper"> <span class='ep-item-term ep-item-term-white-papers' style='--termColor: #707070' >White Papers</span> <h4 class="ep-item-grid-item-title" > <a class='noHover' href='https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Best-Practices-Guide.pdf' > Best Practice Guide Retail </a> </h4> </div> <div class="ep-item-grid-item-button-wrapper"> <a href="https://www.domaintools.com/wp-content/uploads/DomainTools-Retail-Best-Practices-Guide.pdf" class="avia-button avia-color-underline avia-size-medium"> <span class="avia_iconbox_title">Download Now</span> </a> </div> </div> </div> </div> </div></div> </div> </div> </div> </div> </div> </div> </div> </div> <div class="related-posts-section avia-section alternate_color avia-section-huge avia-no-border-styling container_wrap fullsize"> <div class="container"> <div class="content"> <div class="entry-content-wrapper"> <div class="sign-up-wrapper"> <h3 class="sign-up-title">Sign up for our newsletter</h3> <div class="sign-up-link"> <a href="https://www.domaintools.com/newsletter/" class="avia-button avia-icon_select-no avia-color-gray avia-size-medium avia-position-no-align"> <span class="avia_iconbox_title">Sign Up</span> </a> </div> </div> <div class="related-wrapper"> <h3 class="related-title">Related Content</h3> <div class='ep-posts-grid-container ep-grid-wrapper related-posts' ><div class='ep-posts-grid ep-grid columns is-multiline is-mobile is-variable is-3 '><div class="ep-item-grid-item ep-posts-grid-item ep-post-grid-item column is-full-mobile is-half-tablet is-one-third-desktop ep-item-fill entry-common entry-31305 entry-post " > <div class="ep-item-grid-item-inner column-inner"> <div class="ep-item-grid-item-media"> <div class="ep-item-grid-image"> <a class='noHover' href='https://www.domaintools.com/resources/blog/new-developments-usps-smishing-attacks/' > <img width="612" height="344" src="https://www.domaintools.com/wp-content/uploads/New-Developments-USPS-Smishing-Attacks.jpg" class="avia-img-lazy-loading-31326 attachment-post-thumbnail size-post-thumbnail" alt="New Developments in USPS Smishing Attacks" loading="lazy" decoding="async" /> </a> </div> </div> <div class="ep-item-grid-content-wrapper"> <div class="ep-item-grid-item-title-wrapper"> <span class='ep-item-term ep-item-term-blog' style='--termColor: #4c68fd' >Blog</span> <h4 class="ep-item-grid-item-title" > <a class='noHover' href='https://www.domaintools.com/resources/blog/new-developments-usps-smishing-attacks/' > Phishmas Comes Early: New Developments in USPS Smishing Attacks </a> </h4> </div> <div class="ep-item-grid-item-button-wrapper"> <a href="https://www.domaintools.com/resources/blog/new-developments-usps-smishing-attacks/" class="avia-button avia-color-underline avia-size-medium"> <span class="avia_iconbox_title">Read more</span> </a> </div> </div> </div> </div> <div class="ep-item-grid-item ep-posts-grid-item ep-post-grid-item column is-full-mobile is-half-tablet is-one-third-desktop ep-item-fill entry-common entry-31115 entry-post " > <div class="ep-item-grid-item-inner column-inner"> <div class="ep-item-grid-item-media"> <div class="ep-item-grid-image"> <a class='noHover' href='https://www.domaintools.com/resources/blog/post-quantum-cryptography-pqc-you-may-already-be-using-it/' > <img width="1200" height="628" src="https://www.domaintools.com/wp-content/uploads/DomainTools-Blog-Post-Quantum-Cryptography.jpg" class="avia-img-lazy-loading-31125 attachment-post-thumbnail size-post-thumbnail" alt="" loading="lazy" decoding="async" /> </a> </div> </div> <div class="ep-item-grid-content-wrapper"> <div class="ep-item-grid-item-title-wrapper"> <span class='ep-item-term ep-item-term-blog' style='--termColor: #4c68fd' >Blog</span> <h4 class="ep-item-grid-item-title" > <a class='noHover' href='https://www.domaintools.com/resources/blog/post-quantum-cryptography-pqc-you-may-already-be-using-it/' > Post Quantum Cryptography (PQC): You May Already Be Using It! </a> </h4> </div> <div class="ep-item-grid-item-button-wrapper"> <a href="https://www.domaintools.com/resources/blog/post-quantum-cryptography-pqc-you-may-already-be-using-it/" class="avia-button avia-color-underline avia-size-medium"> <span class="avia_iconbox_title">Read more</span> </a> </div> </div> </div> </div> <div class="ep-item-grid-item ep-posts-grid-item ep-post-grid-item column is-full-mobile is-half-tablet is-one-third-desktop ep-item-fill entry-common entry-31130 entry-post " > <div class="ep-item-grid-item-inner column-inner"> <div class="ep-item-grid-item-media"> <div class="ep-item-grid-image"> <a class='noHover' href='https://www.domaintools.com/resources/blog/a-website-attacked/' > <img width="612" height="344" src="https://www.domaintools.com/wp-content/uploads/istockphoto-1027269126-612x612-1.jpg" class="avia-img-lazy-loading-31161 attachment-post-thumbnail size-post-thumbnail" alt="" loading="lazy" decoding="async" /> </a> </div> </div> <div class="ep-item-grid-content-wrapper"> <div class="ep-item-grid-item-title-wrapper"> <span class='ep-item-term ep-item-term-blog' style='--termColor: #4c68fd' >Blog</span> <h4 class="ep-item-grid-item-title" > <a class='noHover' href='https://www.domaintools.com/resources/blog/a-website-attacked/' > A Website Attacked </a> </h4> </div> <div class="ep-item-grid-item-button-wrapper"> <a href="https://www.domaintools.com/resources/blog/a-website-attacked/" class="avia-button avia-color-underline avia-size-medium"> <span class="avia_iconbox_title">Read more</span> </a> </div> </div> </div> </div> </div></div> </div> </div> </div> </div> </div> <div class="footer-page-content footer_color" id="footer-page"><div id='av_section_1' class='avia-section alternate_color avia-section-default avia-no-border-styling avia-bg-style-scroll avia-builder-el-0 avia-builder-el-no-sibling footer-section container_wrap fullsize' style='background-color: #1b1f29; ' ><div class='container' ><main class='template-page content av-content-full alpha units' ><div class='post-entry post-entry-type-page post-entry-30810'><div class='entry-content-wrapper clearfix'> <span class="av_font_icon avia_animate_when_visible avia-icon-animate av-icon-style- av-no-color avia-icon-pos-left avia-icon-pos-left avia-icon-pos-left" style=""><span class='av-icon-char' style='font-size:40px;line-height:40px;' aria-hidden='true' data-av_icon='' data-av_iconfont='fa-fontello' ></span></span> <div class='flex_column_table avia-full-stretch footer--main-row av-equal-height-column-flextable -flextable flex-column-table-1 ' ><div class="flex_column av_one_half flex_column_table_cell av-equal-height-column av-align-top av-zero-column-padding first avia-builder-el-2 el_after_av_font_icon el_before_av_one_half " ><div class="flex-column-inner"><div class='avia-image-container av-styling- ep-image-mobile-center avia-builder-el-3 avia-builder-el-no-sibling avia-align-left' style='max-width:286px; '><div class='avia-image-container-inner'><div class='avia-image-overlay-wrap'><a href='https://www.domaintools.com/' class='avia_image' ><img width="573" height="99" class='avia_image' loading='lazy' src='https://www.domaintools.com/wp-content/uploads/dev-DomainTools-Logo-RC.png' alt='DomainTools Logo' title='DomainTools Logo' /></a></div></div></div></div></div><div class='av-flex-placeholder' ></div><div class="flex_column av_one_half flex_column_table_cell av-equal-height-column av-align-top av-zero-column-padding avia-builder-el-4 el_after_av_one_half el_before_av_one_fifth " ><div class="flex-column-inner"><div class='avia-buttonrow-wrap avia-buttonrow-right avia-buttonrow-tablet-left avia-builder-el-5 avia-builder-el-no-sibling footer--buttons' > <a href='https://www.domaintools.com/pricing/' class='avia-button avia-icon_select-no avia-color-underline avia-size-medium' style='margin-bottom:5px; margin-left:5px; ' ><span class='avia_iconbox_title' >Pricing</span></a> <a href='https://www.domaintools.com/contact/' class='avia-button avia-icon_select-no avia-color-underline avia-size-medium' style='margin-bottom:5px; margin-left:5px; ' ><span class='avia_iconbox_title' >Contact</span></a> <a href='https://account.domaintools.com/log-in/?r=http%3A/whois.domaintools.com' class='avia-button avia-icon_select-no avia-color-underline avia-size-medium' target="_blank" style='margin-bottom:5px; margin-left:5px; ' rel="noopener"><span class='avia_iconbox_title' >Login</span></a> <a href='https://www.domaintools.com/support/' class='avia-button avia-icon_select-no avia-color-underline avia-size-medium' style='margin-bottom:5px; margin-left:5px; ' ><span class='avia_iconbox_title' >Support</span></a> <a href='https://www.domaintools.com/demo/' class='avia-button avia-icon_select-no avia-color-orange avia-size-medium' style='margin-bottom:5px; margin-left:5px; ' ><span class='avia_iconbox_title' >Request a Demo</span></a> </div></div></div></div><div class='flex_column_table avia-full-stretch footer--second-row av-equal-height-column-flextable av-break-at-tablet-flextable flex-column-table-2 ' ><div class="flex_column av_one_fifth av-break-at-tablet flex_column_table_cell av-equal-height-column av-align-top first avia-builder-el-6 el_after_av_one_half el_before_av_one_fifth column-top-margin" ><div class="flex-column-inner"><div class='ep-custom-menu-element ep-custom-menu-style-vertical avia-builder-el-7 avia-builder-el-no-sibling '> <ul id="menu-footer-solutions-menu" class="menu" role="menu"><li role="menuitem" id="menu-item-6565" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-top-level menu-item-top-level-1"><a href="https://www.domaintools.com/solutions/" tabindex="0"><span class="avia-menu-text">Solutions</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-13875" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a tabindex="0"><span class="avia-menu-text">Use Cases</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-6567" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/use-cases/threat-intelligence/" tabindex="0"><span class="avia-menu-text">Threat Intelligence</span></a></li> <li role="menuitem" id="menu-item-6568" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/use-cases/phishing-fraud-prevention/" tabindex="0"><span class="avia-menu-text">Phishing and Fraud Prevention</span></a></li> <li role="menuitem" id="menu-item-6569" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/use-cases/threat-hunting/" tabindex="0"><span class="avia-menu-text">Threat Hunting</span></a></li> <li role="menuitem" id="menu-item-6570" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/use-cases/brand-protection/" tabindex="0"><span class="avia-menu-text">Brand Protection</span></a></li> <li role="menuitem" id="menu-item-6571" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/use-cases/forensics-incident-response/" tabindex="0"><span class="avia-menu-text">Forensics & Incident Response</span></a></li> <li role="menuitem" id="menu-item-10103" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/use-cases/application-enrichment/" tabindex="0"><span class="avia-menu-text">Application Enrichment</span></a></li> </ul> </li> <li role="menuitem" id="menu-item-23874" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Industries</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-23878" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/industry/government/" tabindex="0"><span class="avia-menu-text">Federal Government</span></a></li> <li role="menuitem" id="menu-item-23877" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/industry/financial-services/" tabindex="0"><span class="avia-menu-text">Financial Services</span></a></li> <li role="menuitem" id="menu-item-23876" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/industry/healthcare/" tabindex="0"><span class="avia-menu-text">Healthcare</span></a></li> <li role="menuitem" id="menu-item-23880" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/industry/technology/" tabindex="0"><span class="avia-menu-text">Technology</span></a></li> <li role="menuitem" id="menu-item-28320" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/solutions/industry/retail/" tabindex="0"><span class="avia-menu-text">Retail</span></a></li> </ul> </li> </ul> </li> </ul> </div></div></div><div class='av-flex-placeholder' ></div><div class="flex_column av_one_fifth av-break-at-tablet flex_column_table_cell av-equal-height-column av-align-top avia-builder-el-8 el_after_av_one_fifth el_before_av_one_fifth column-top-margin" ><div class="flex-column-inner"><div class='ep-custom-menu-element ep-custom-menu-style-vertical avia-builder-el-9 avia-builder-el-no-sibling '> <ul id="menu-footer-products-menu" class="menu" role="menu"><li role="menuitem" id="menu-item-11666" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-top-level menu-item-top-level-1"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Products</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-11358" class="menu-item menu-item-type-post_type menu-item-object-product menu-item-has-children"><a href="https://www.domaintools.com/products/platform/" tabindex="0"><span class="avia-menu-text">Iris Platform</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-11360" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/platform/iris-detect/" tabindex="0"><span class="avia-menu-text">Iris Detect </span></a></li> <li role="menuitem" id="menu-item-11361" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/platform/iris-enrich/" tabindex="0"><span class="avia-menu-text">Iris Enrich</span></a></li> <li role="menuitem" id="menu-item-11359" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/platform/iris-investigate/" tabindex="0"><span class="avia-menu-text">Iris Investigate</span></a></li> </ul> </li> <li role="menuitem" id="menu-item-11364" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/farsight-dnsdb/" tabindex="0"><span class="avia-menu-text">Farsight DNSDB</span></a></li> <li role="menuitem" id="menu-item-11367" class="menu-item menu-item-type-post_type menu-item-object-product menu-item-has-children"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/" tabindex="0"><span class="avia-menu-text">Threat Intelligence Feeds</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-11373" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/predictive-risk-scoring/" tabindex="0"><span class="avia-menu-text">Predictive Risk Scoring</span></a></li> <li role="menuitem" id="menu-item-11375" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/predictive-risk-scoring/hosting-ip-risk-feed-hotlist/" tabindex="0"><span class="avia-menu-text">Hosting IP Risk Feed & Hotlist</span></a></li> <li role="menuitem" id="menu-item-11374" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/predictive-risk-scoring/domain-risk-feed-hotlist/" tabindex="0"><span class="avia-menu-text">Domain Risk Feed & Hotlist</span></a></li> <li role="menuitem" id="menu-item-11368" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/domain-visibility/" tabindex="0"><span class="avia-menu-text">Domain Visibility Feed</span></a></li> <li role="menuitem" id="menu-item-11372" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/domain-visibility/domain-discovery-feed/" tabindex="0"><span class="avia-menu-text">Domain Discovery Feed</span></a></li> <li role="menuitem" id="menu-item-11371" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/domain-visibility/farsight-nad/" tabindex="0"><span class="avia-menu-text">Farsight Newly Active Domains</span></a></li> <li role="menuitem" id="menu-item-11370" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/domain-visibility/farsight-noh/" tabindex="0"><span class="avia-menu-text">Farsight Newly Observed Hostnames</span></a></li> <li role="menuitem" id="menu-item-11369" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/threat-intelligence-feeds/domain-visibility/farsight-nod/" tabindex="0"><span class="avia-menu-text">Farsight Newly Observed Domains</span></a></li> </ul> </li> <li role="menuitem" id="menu-item-11366" class="menu-item menu-item-type-post_type menu-item-object-product"><a href="https://www.domaintools.com/products/monitors/" tabindex="0"><span class="avia-menu-text">DomainTools Monitors</span></a></li> </ul> </li> </ul> </div></div></div><div class='av-flex-placeholder' ></div><div class="flex_column av_one_fifth av-break-at-tablet flex_column_table_cell av-equal-height-column av-align-top avia-builder-el-10 el_after_av_one_fifth el_before_av_one_fifth column-top-margin" ><div class="flex-column-inner"><div class='ep-custom-menu-element ep-custom-menu-style-vertical avia-builder-el-11 avia-builder-el-no-sibling '> <ul id="menu-footer-integrations-menu" class="menu" role="menu"><li role="menuitem" id="menu-item-11395" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-top-level menu-item-top-level-1"><a href="https://www.domaintools.com/integrations/" tabindex="0"><span class="avia-menu-text">Integrations</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-13800" class="menu-item menu-item-type-custom menu-item-object-custom"><a href="https://domaintools.com/integrations/?_integration=siem" tabindex="0"><span class="avia-menu-text">SIEM</span></a></li> <li role="menuitem" id="menu-item-13801" class="menu-item menu-item-type-custom menu-item-object-custom"><a href="https://domaintools.com/integrations/?_integration=soar" tabindex="0"><span class="avia-menu-text">SOAR</span></a></li> <li role="menuitem" id="menu-item-13802" class="menu-item menu-item-type-custom menu-item-object-custom"><a href="https://domaintools.com/integrations/?_integration=threat-intelligence" tabindex="0"><span class="avia-menu-text">Threat Intelligence</span></a></li> <li role="menuitem" id="menu-item-11399" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/anomali/" tabindex="0"><span class="avia-menu-text">Anomali</span></a></li> <li role="menuitem" id="menu-item-11393" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/cortex-xsoar/" tabindex="0"><span class="avia-menu-text">Cortex XSOAR</span></a></li> <li role="menuitem" id="menu-item-11389" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/crowdstrike/" tabindex="0"><span class="avia-menu-text">CrowdStrike</span></a></li> <li role="menuitem" id="menu-item-11402" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/elastic/" tabindex="0"><span class="avia-menu-text">Elastic</span></a></li> <li role="menuitem" id="menu-item-11403" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/ibm-qradar/" tabindex="0"><span class="avia-menu-text">IBM QRadar</span></a></li> <li role="menuitem" id="menu-item-11404" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/ibm-resilient/" tabindex="0"><span class="avia-menu-text">IBM Resilient</span></a></li> <li role="menuitem" id="menu-item-11405" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/maltego/" tabindex="0"><span class="avia-menu-text">Maltego</span></a></li> <li role="menuitem" id="menu-item-11406" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/misp/" tabindex="0"><span class="avia-menu-text">MISP</span></a></li> <li role="menuitem" id="menu-item-11410" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/splunk/" tabindex="0"><span class="avia-menu-text">Splunk</span></a></li> <li role="menuitem" id="menu-item-11413" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/splunk-soar/" tabindex="0"><span class="avia-menu-text">Splunk SOAR</span></a></li> <li role="menuitem" id="menu-item-11390" class="menu-item menu-item-type-post_type menu-item-object-integration"><a href="https://www.domaintools.com/integrations/thehive-and-cortex/" tabindex="0"><span class="avia-menu-text">TheHive and Cortex</span></a></li> </ul> </li> </ul> </div></div></div><div class='av-flex-placeholder' ></div><div class="flex_column av_one_fifth av-break-at-tablet flex_column_table_cell av-equal-height-column av-align-top avia-builder-el-12 el_after_av_one_fifth el_before_av_one_fifth column-top-margin" ><div class="flex-column-inner"><div class='ep-custom-menu-element ep-custom-menu-style-vertical avia-builder-el-13 avia-builder-el-no-sibling '> <ul id="menu-footer-partners-company-menu" class="menu" role="menu"><li role="menuitem" id="menu-item-11676" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-top-level menu-item-top-level-1"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Partners</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-11678" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/partners/resell-partner-program/" tabindex="0"><span class="avia-menu-text">Reseller Partner</span></a></li> <li role="menuitem" id="menu-item-6769" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/partners/become-a-technology-partner/" tabindex="0"><span class="avia-menu-text">Technology Partners</span></a></li> <li role="menuitem" id="menu-item-6770" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/partners/mssp-partners/" tabindex="0"><span class="avia-menu-text">MSSP Partners</span></a></li> <li role="menuitem" id="menu-item-6781" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/partners/oem-partners/" tabindex="0"><span class="avia-menu-text">OEM Partners</span></a></li> <li role="menuitem" id="menu-item-6782" class="menu-item menu-item-type-custom menu-item-object-custom"><a target="_blank" href="http://domaintools.allbound.com/" tabindex="0" rel="noopener"><span class="avia-menu-text">Partner Portal</span></a></li> </ul> </li> <li role="menuitem" id="menu-item-6783" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-top-level menu-item-top-level-2"><a href="https://www.domaintools.com/company/" tabindex="0"><span class="avia-menu-text">Company</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-6784" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/company/leadership/" tabindex="0"><span class="avia-menu-text">Leadership</span></a></li> <li role="menuitem" id="menu-item-6785" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/company/careers/" tabindex="0"><span class="avia-menu-text">Careers</span></a></li> <li role="menuitem" id="menu-item-6786" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/company/press/" tabindex="0"><span class="avia-menu-text">Pressroom</span></a></li> </ul> </li> </ul> </div></div></div><div class='av-flex-placeholder' ></div><div class="flex_column av_one_fifth av-break-at-tablet flex_column_table_cell av-equal-height-column av-align-top avia-builder-el-14 el_after_av_one_fifth el_before_av_one_half column-top-margin" ><div class="flex-column-inner"><div class='ep-custom-menu-element ep-custom-menu-style-vertical avia-builder-el-15 el_before_ep_social_profiles avia-builder-el-first '> <ul id="menu-footer-resources-menu" class="menu" role="menu"><li role="menuitem" id="menu-item-6788" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-top-level menu-item-top-level-1"><a href="javascript:void(0);" tabindex="0"><span class="avia-menu-text">Resources</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-6790" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children"><a href="https://www.domaintools.com/resources/" tabindex="0"><span class="avia-menu-text">Resource Center</span></a> <ul role="menu" class="sub-menu"> <li role="menuitem" id="menu-item-6798" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/resources/api-documentation/" tabindex="0"><span class="avia-menu-text">API Documentation</span></a></li> <li role="menuitem" id="menu-item-31012" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/events/" tabindex="0"><span class="avia-menu-text">Events</span></a></li> </ul> </li> <li role="menuitem" id="menu-item-6801" class="menu-item menu-item-type-post_type menu-item-object-page"><a href="https://www.domaintools.com/support/" tabindex="0"><span class="avia-menu-text">Support and Learning</span></a></li> </ul> </li> </ul> </div> <div class='ep-social-bookmarks-wrapper avia-builder-el-16 el_after_ep_custom_menu avia-builder-el-last footer--social-profiles'> <ul class='noLightbox ep-social-bookmarks ep-align-left icon_count_4'><li class='ep-social-bookmarks ep-align-left_rss av-social-link-rss social_icon_1'><a target="_blank" aria-label="Link to Rss this site" href='https://domaintools.com/rss' aria-hidden='false' data-av_icon='' data-av_iconfont='entypo-fontello' title='Rss' rel="noopener"><span class='avia_hidden_link_text'>Rss</span></a></li><li class='ep-social-bookmarks ep-align-left_facebook av-social-link-facebook social_icon_2'><a target="_blank" aria-label="Link to Facebook" href='https://www.facebook.com/domaintoolsllc/' aria-hidden='false' data-av_icon='' data-av_iconfont='fa-fontello' title='Facebook' rel="noopener"><span class='avia_hidden_link_text'>Facebook</span></a></li><li class='ep-social-bookmarks ep-align-left_twitter av-social-link-twitter social_icon_3'><a target="_blank" aria-label="Link to Twitter" href='https://twitter.com/domaintools/' aria-hidden='false' data-av_icon='' data-av_iconfont='fa-fontello' title='Twitter' rel="noopener"><span class='avia_hidden_link_text'>Twitter</span></a></li><li class='ep-social-bookmarks ep-align-left_linkedin av-social-link-linkedin social_icon_4'><a target="_blank" aria-label="Link to Linkedin" href='https://www.linkedin.com/company/domaintools/' aria-hidden='false' data-av_icon='' data-av_iconfont='fa-fontello' title='Linkedin' rel="noopener"><span class='avia_hidden_link_text'>Linkedin</span></a></li></ul> </div></div></div></div><div class='flex_column_table avia-full-stretch footer--socket-row av-equal-height-column-flextable av-break-at-tablet-flextable flex-column-table-3 ' ><div class="flex_column av_one_half av-break-at-tablet flex_column_table_cell av-equal-height-column av-align-top first avia-builder-el-17 el_after_av_one_fifth el_before_av_one_half column-top-margin" ><div class="flex-column-inner"><section class="av_textblock_section " ><div class='avia_textblock footer--copyright ' ><p>© 2024 DomainTools</p> <p>DomainTools® and DomainTools™ are owned by DomainTools, all rights reserved.</p> </div></section></div></div><div class='av-flex-placeholder' ></div><div class="flex_column av_one_half av-break-at-tablet flex_column_table_cell av-equal-height-column av-align-top avia-builder-el-19 el_after_av_one_half avia-builder-el-last column-top-margin" ><div class="flex-column-inner"><section class="av_textblock_section " ><div class='avia_textblock footer--privacy ' ><p style="text-align: right;"><a href="/company/privacy-policy/">Privacy Policy</a> | <a href="/company/california-privacy-notice/">California Privacy </a><a href="#">Notice</a><br /> <a href="/company/california-privacy-notice/do-not-sell/">Do Not Sell My Personal Information</a> | <a href="/company/terms-of-service/">Terms of Service</a> | <a href="/sitemap/">Sitemap</a></p> </div></section></div></div></div></p> </div></div></main>  </div></div></div>  </div> </div> <div data-wpr-lazyrender="1" id="fb-root"></div> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type='text/javascript'> /* <![CDATA[ */ var avia_framework_globals = avia_framework_globals || {}; avia_framework_globals.frameworkUrl = 'https://www.domaintools.com/wp-content/themes/enfold/framework/'; avia_framework_globals.installedAt = 'https://www.domaintools.com/wp-content/themes/enfold/'; avia_framework_globals.ajaxurl = 'https://www.domaintools.com/wp-admin/admin-ajax.php'; /* ]]> */ </script> <script type="text/javascript" id="rocket-browser-checker-js-after"> /* <![CDATA[ */ "use strict";var _createClass=function(){function defineProperties(target,props){for(var i=0;i<props.length;i++){var descriptor=props[i];descriptor.enumerable=descriptor.enumerable||!1,descriptor.configurable=!0,"value"in descriptor&&(descriptor.writable=!0),Object.defineProperty(target,descriptor.key,descriptor)}}return function(Constructor,protoProps,staticProps){return protoProps&&defineProperties(Constructor.prototype,protoProps),staticProps&&defineProperties(Constructor,staticProps),Constructor}}();function _classCallCheck(instance,Constructor){if(!(instance instanceof Constructor))throw new TypeError("Cannot call a class as a function")}var RocketBrowserCompatibilityChecker=function(){function RocketBrowserCompatibilityChecker(options){_classCallCheck(this,RocketBrowserCompatibilityChecker),this.passiveSupported=!1,this._checkPassiveOption(this),this.options=!!this.passiveSupported&&options}return _createClass(RocketBrowserCompatibilityChecker,[{key:"_checkPassiveOption",value:function(self){try{var options={get passive(){return!(self.passiveSupported=!0)}};window.addEventListener("test",null,options),window.removeEventListener("test",null,options)}catch(err){self.passiveSupported=!1}}},{key:"initRequestIdleCallback",value:function(){!1 in window&&(window.requestIdleCallback=function(cb){var start=Date.now();return setTimeout(function(){cb({didTimeout:!1,timeRemaining:function(){return Math.max(0,50-(Date.now()-start))}})},1)}),!1 in window&&(window.cancelIdleCallback=function(id){return clearTimeout(id)})}},{key:"isDataSaverModeOn",value:function(){return"connection"in navigator&&!0===navigator.connection.saveData}},{key:"supportsLinkPrefetch",value:function(){var elem=document.createElement("link");return elem.relList&&elem.relList.supports&&elem.relList.supports("prefetch")&&window.IntersectionObserver&&"isIntersecting"in IntersectionObserverEntry.prototype}},{key:"isSlowConnection",value:function(){return"connection"in navigator&&"effectiveType"in navigator.connection&&("2g"===navigator.connection.effectiveType||"slow-2g"===navigator.connection.effectiveType)}}]),RocketBrowserCompatibilityChecker}(); /* ]]> */ </script> <script type="text/javascript" id="rocket-preload-links-js-extra"> /* <![CDATA[ */ var RocketPreloadLinksConfig = {"excludeUris":"\/(?:.+\/)?feed(?:\/(?:.+\/?)?)?$|\/(?:.+\/)?embed\/|\/(index.php\/)?(.*)wp-json(\/.*|$)|\/refer\/|\/go\/|\/recommend\/|\/recommends\/","usesTrailingSlash":"1","imageExt":"jpg|jpeg|gif|png|tiff|bmp|webp|avif|pdf|doc|docx|xls|xlsx|php","fileExt":"jpg|jpeg|gif|png|tiff|bmp|webp|avif|pdf|doc|docx|xls|xlsx|php|html|htm","siteUrl":"https:\/\/www.domaintools.com","onHoverDelay":"100","rateThrottle":"3"}; /* ]]> */ </script> <script type="text/javascript" id="rocket-preload-links-js-after"> /* <![CDATA[ */ (function() { "use strict";var r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e=function(){function i(e,t){for(var n=0;n<t.length;n++){var i=t[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(e,i.key,i)}}return function(e,t,n){return t&&i(e.prototype,t),n&&i(e,n),e}}();function i(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}var t=function(){function n(e,t){i(this,n),this.browser=e,this.config=t,this.options=this.browser.options,this.prefetched=new Set,this.eventTime=null,this.threshold=1111,this.numOnHover=0}return e(n,[{key:"init",value:function(){!this.browser.supportsLinkPrefetch()||this.browser.isDataSaverModeOn()||this.browser.isSlowConnection()||(this.regex={excludeUris:RegExp(this.config.excludeUris,"i"),images:RegExp(".("+this.config.imageExt+")$","i"),fileExt:RegExp(".("+this.config.fileExt+")$","i")},this._initListeners(this))}},{key:"_initListeners",value:function(e){-1<this.config.onHoverDelay&&document.addEventListener("mouseover",e.listener.bind(e),e.listenerOptions),document.addEventListener("mousedown",e.listener.bind(e),e.listenerOptions),document.addEventListener("touchstart",e.listener.bind(e),e.listenerOptions)}},{key:"listener",value:function(e){var t=e.target.closest("a"),n=this._prepareUrl(t);if(null!==n)switch(e.type){case"mousedown":case"touchstart":this._addPrefetchLink(n);break;case"mouseover":this._earlyPrefetch(t,n,"mouseout")}}},{key:"_earlyPrefetch",value:function(t,e,n){var i=this,r=setTimeout(function(){if(r=null,0===i.numOnHover)setTimeout(function(){return i.numOnHover=0},1e3);else if(i.numOnHover>i.config.rateThrottle)return;i.numOnHover++,i._addPrefetchLink(e)},this.config.onHoverDelay);t.addEventListener(n,function e(){t.removeEventListener(n,e,{passive:!0}),null!==r&&(clearTimeout(r),r=null)},{passive:!0})}},{key:"_addPrefetchLink",value:function(i){return this.prefetched.add(i.href),new Promise(function(e,t){var n=document.createElement("link");n.rel="prefetch",n.href=i.href,n.onload=e,n.onerror=t,document.head.appendChild(n)}).catch(function(){})}},{key:"_prepareUrl",value:function(e){if(null===e||"object"!==(void 0===e?"undefined":r(e))||!1 in e||-1===["http:","https:"].indexOf(e.protocol))return null;var t=e.href.substring(0,this.config.siteUrl.length),n=this._getPathname(e.href,t),i={original:e.href,protocol:e.protocol,origin:t,pathname:n,href:t+n};return this._isLinkOk(i)?i:null}},{key:"_getPathname",value:function(e,t){var n=t?e.substring(this.config.siteUrl.length):e;return n.startsWith("/")||(n="/"+n),this._shouldAddTrailingSlash(n)?n+"/":n}},{key:"_shouldAddTrailingSlash",value:function(e){return this.config.usesTrailingSlash&&!e.endsWith("/")&&!this.regex.fileExt.test(e)}},{key:"_isLinkOk",value:function(e){return null!==e&&"object"===(void 0===e?"undefined":r(e))&&(!this.prefetched.has(e.href)&&e.origin===this.config.siteUrl&&-1===e.href.indexOf("?")&&-1===e.href.indexOf("#")&&!this.regex.excludeUris.test(e.href)&&!this.regex.images.test(e.href))}}],[{key:"run",value:function(){"undefined"!=typeof RocketPreloadLinksConfig&&new n(new RocketBrowserCompatibilityChecker({capture:!0,passive:!0}),RocketPreloadLinksConfig).init()}}]),n}();t.run(); }()); /* ]]> */ </script> <script data-minify="1" type="text/javascript" src="https://www.domaintools.com/wp-content/cache/min/1/wp-content/themes/domaintools/assets/js/gutenberg-ol.js?ver=1731584868" id="ol-ul-fix-js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.17.1/prism.min.js?ver=62" id="prism-js-main-js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.17.1/plugins/autoloader/prism-autoloader.min.js" id="prism-js-autoloader-js"></script> <script data-minify="1" type="text/javascript" src="https://www.domaintools.com/wp-content/cache/min/1/wp-content/uploads/dynamic_avia/avia-footer-scripts-24b0a2bc00cb4bc3e3a19c4004fe57f4---673e1b696f1fb.js?ver=1732123497" id="avia-footer-scripts-js"></script> <script>document.write('<link data-minify="1" rel="stylesheet" href="https://www.domaintools.com/wp-content/cache/min/1/wp-content/plugins/enfold-fast/assets/css/body.css?ver=1731579767">');</script> <script>document.write('<link data-minify="1" rel="stylesheet" href="https://www.domaintools.com/wp-content/cache/min/1/wp-content/themes/domaintools/assets/css/body.css?ver=1731579767">');</script> <script>window.lazyLoadOptions={elements_selector:"iframe[data-lazy-src]",data_src:"lazy-src",data_srcset:"lazy-srcset",data_sizes:"lazy-sizes",class_loading:"lazyloading",class_loaded:"lazyloaded",threshold:300,callback_loaded:function(element){if(element.tagName==="IFRAME"&&element.dataset.rocketLazyload=="fitvidscompatible"){if(element.classList.contains("lazyloaded")){if(typeof window.jQuery!="undefined"){if(jQuery.fn.fitVids){jQuery(element).parent().fitVids()}}}}}};window.addEventListener('LazyLoad::Initialized',function(e){var lazyLoadInstance=e.detail.instance;if(window.MutationObserver){var observer=new MutationObserver(function(mutations){var image_count=0;var iframe_count=0;var rocketlazy_count=0;mutations.forEach(function(mutation){for(var i=0;i<mutation.addedNodes.length;i++){if(typeof mutation.addedNodes[i].getElementsByTagName!=='function'){continue} if(typeof mutation.addedNodes[i].getElementsByClassName!=='function'){continue} images=mutation.addedNodes[i].getElementsByTagName('img');is_image=mutation.addedNodes[i].tagName=="IMG";iframes=mutation.addedNodes[i].getElementsByTagName('iframe');is_iframe=mutation.addedNodes[i].tagName=="IFRAME";rocket_lazy=mutation.addedNodes[i].getElementsByClassName('rocket-lazyload');image_count+=images.length;iframe_count+=iframes.length;rocketlazy_count+=rocket_lazy.length;if(is_image){image_count+=1} if(is_iframe){iframe_count+=1}}});if(image_count>0||iframe_count>0||rocketlazy_count>0){lazyLoadInstance.update()}});var b=document.getElementsByTagName("body")[0];var config={childList:!0,subtree:!0};observer.observe(b,config)}},!1)</script><script data-no-minify="1" async src="https://www.domaintools.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js"></script></body> </html>