Join us at #BlackHaUSA 🎩 to learn more about how DomainTools can help you identify external risks, optimize your resources, and stop attacks before they happen: https://www.domaintools.com/events/black-hat-usa?utm_campaign=bh2026&utm_medium=social&utm_source=twitter

DTI is back on the CyberWire! Our Head of Investigations and CISO, @danonsecurity.bsky.social, sat down with Dave Bittner for the Research Saturday Podcast to discuss our research on the ZionSiphon malware. Listen to the podcast on your favorite platform ⬇️ thecyberwire.com/podcasts/res... #podcast

🚰DTI just released research analyzing the recent trend of nation-state directed cyber activity against water systems. Read our investigation here ⬇️ https://dti.domaintools.com/research/threat-intelligence-report-nation-state-targeting-of-water-systems-2024-2026

DomainTools is coming to #BlackHatUSA in Las Vegas, August 1-6!🎩 🗓️Book a time to meet with our team! https://www.domaintools.com/events/black-hat-usa?utm_campaign=bh2026&utm_medium=social&utm_source=twitter

Russian threat actors are bypassing EDR to hijack SOHO routers, bend DNS, and phish Signal/WhatsApp for long-term espionage. Read the full technical breakdown & MITRE mapping: https://dti.domaintools.com/research/threat-intelligence-report-russia-router-dns-and-messaging-layer-collection-operations

👔We’ve analyzed a highly sophisticated Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 & Entra ID. Active since Dec 2025, it smoothly bypasses traditional MFA. Read the investigation here:http://dti.domaintools.com/securitysnacks/securitysnack-hijacking-corporate-sessions

The DomainTools team is at SLEUTHCON! Stop by our booth to say hi and grab a "Zero Day" t-shirt, (and no, we won't pitch our product before you can get a shirt) ! #Cybersecurity #SLEUTHCON #InfoSec #Cybercrime

This Friday, we'll be at #SLEUTHCON ! Stop by our booth to say hi and enter our raffle to win a Nintendo Switch 2: Choose Your Own Game Bundle! #SLEUTHCON2026 #Cybersecurity #Infosec

Our team at DomainTools Investigations (DTI) took a deep dive into the ZionSiphon malware sample that’s been circling in sandboxes since 2025. Read our investigation here⬇️ http://dti.domaintools.com/research/threat-intelligence-report-zionsiphon #Cybersecurity #Malware #InfoSec #ICS

Announcing our IP risk and IP hotlist are now available in real-time feeds, giving you access to all IP addresses to show the most dangerous and currently active infrastructure. Learn more: https://www.domaintools.com/blog/increase-threat-visibility-with-domaintools-real-time-ip-risk-feeds

📰Real Fake News: DTI’s latest research on the Russian-backed Doppelgänger campaigns breaks down the organizational structure and operational distribution model that pushes “fake news” to real news feeds. Read more: https://dti.domaintools.com/research/sda-structura-doppelganger-influence-ops

The sun is out in Seattle and the April DTI newsletter is live! 📰☀️ @danonsecurity.bsky.social breaks down the DPRK’s modular malware pipelines, the MOIS-linked Handala ecosystem, and the AI Frame campaign. Plus, Ian Campbell's monthly reading list! 📚 Catch up: dti.domaintools.com/newsletters/...

Government agencies are advancing Zero Trust, but are they fully leveraging DNS intelligence? DomainTools helps teams uncover adversary infrastructure before it becomes a threat. Learn how our data empowers defenders: https://www.domaintools.com/proactive-internet-intelligence-for-the-public-sector

DTI just released an analysis of the DPRK’s “Contagious Interview” campaign😷. Read the investigation to learn how the campaign targets software developers through fraudulent job interview processes.⬇️ https://dti.domaintools.com/securitysnacks/dprk-contagious-interview-developer-workflow-compromise

Join our webinar: Supercharging the SOC with DomainTools MCP to learn how to supercharge your workflow using DomainTools MCP. 🗓️May 07, 2026 🕜 10:00 AM PT/1:00 PM ET 🔗www.domaintools.com/webinars/supercharging-the-soc-with-domaintools-mcp?utm_campaign=mcpwebinar&utm_medium=social&utm_source=twitter

ICYMI: IrisQL, our new query language, makes it easier than ever to share logic across teams and ticketing systems. Explore how to optimize your security stack here: https://www.domaintools.com/blog/supercharge-your-threat-investigations-with-irisql #ThreatHunting #IrisQL #Infosec #DataScience

💥Level up your threat hunting with IrisQL, our new query language for deeper, more flexible access to the Iris Investigate database. Explore the full breakdown and start optimizing your security stack here: https://www.domaintools.com/blog/supercharge-your-threat-investigations-with-irisql

Deploy clean, update dirty🧼 DTI identifies a Chrome extension tied to a malicious campaign that publishes utility software that has legitimate functionality but with pre-staged capability for malicious use Learn more: https://dti.domaintools.com/securitysnacks/the-ai-frame-campaign-continues#details

Join us for the our webinar: Supercharging the SOC with DomainTools MCP Key takeaways: ⏱️Instant Context 🏁 Faster Response 🔎Enhanced Analysis 🧠Verifiable Intelligence 🔗www.domaintools.com/webinars/supercharging-the-soc-with-domaintools-mcp?utm_campaign=mcpwebinar&utm_medium=social&utm_source=twitter

📍 We’re in Singapore for #BHA2026! Stop by DomainTools booth # 119 to see how our integrations reduce context-switching and identify evolving threats in real-time. It's not too late to schedule a chat ➡️ https://www.domaintools.com/events/black-hat-asia#BHA2026 #BlackHatAsia #CyberSecurity

New: The evolution of the MOIS-linked cyber ecosystem (Handala/Homeland Justice) from the 2022 Albania attacks to the 2026 Stryker incident🛡️🇮🇷 Full investigation:https://dti.domaintools.com/research/mois-linked-moist-grasshopper-homeland-justice-karmabelow80-handala-hackers-campaigns-and-evolution

📍 Singapore bound for #BHA2026! Stop by DomainTools booth # 119 to see how our integrations reduce context-switching and identify evolving threats in real-time. Don't leave your 2026 strategy to chance. Schedule a chat➡️ https://www.domaintools.com/events/black-hat-asia#BHA2026 #BlackHatAsia #CyberSecurity

Spring is here in Seattle🌷, and the March DTI newsletter is live📰. In this edition Daniel Schwalbe recaps a busy month of research, Ian Campbell's monthly reading list, and where to find us next! https://dti.domaintools.com/newsletters/fifteen-newsletters-on-a-skateboard

Access DomainTools via the Model Context Protocol (MCP) 🌐 Connect your LLM or MCP enabled platform directly to our data to: ✅ Automate data retrieval and analysis ✅ Reduce context-switching ✅ Investigate at the speed of AI Click here to learn more (https://www.domaintools.ai/mcp-access.

The most critical indicators, all in one place New enhancements to the DomainTools App for Cortex by Palo Alto Networks deliver real-time streaming of critical intelligence feeds, providing seamless access to DomainTools data across Cortex. Learn more: www.domaintools.com/blog/domaint...

Want to see how the world's best CTI teams map adversary DNS? 🗺️ We’re heading to #BlackHatAsia 2026 to share how we provide 97% internet visibility and detection 10 days ahead of blocklists. Let's grab coffee! Book 20 mins here ➡️ https://www.domaintools.com/events/black-hat-asia#BlackHatAsia #BHA2026 #OSINT

DTI just released an analysis of activity attributed to Homeland Justice, Karma/KarmaBelow80, and Handala as a coordinated cyber influence ecosystem aligned with Iran’s MOIS. Read more: https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment

Connecting your LLM to DomainTools is an instant force multiplier⚡ Get Domain intelligence directly in your chat interface. No context-switching - just natural language answers at the speed of AI. Technical breakdown⬇️ https://www.domaintools.com/blog/integrating-domaintools-into-the-ai-powered-soc

🇰🇵Beyond the Fracture: DomainTools Investigations’ latest research analyzes the fragmented and parallel development pipelines behind North Korea’s specialized malware ecosystem. Read the research here:https://dti.domaintools.com/research/dprk-malware-modularity-diversity-and-functional-specialization

Our MCP server brings DomainTools to your LLM. Investigation flow: 1️⃣ Prompt: “Look up [domain].” 2️⃣AI: Returns Risk Score & profile including IP 3️⃣Deep Dive: “What other domains are linked to this IP?” 4️⃣Result: Instant infrastructure map. Request a demo now: https://www.domaintools.ai/mcp-access

At #FIC2026?🇫🇷 Don't miss our Principal Engineer Maxime Zielony's presentation tomorrow! 🎤 From Days to Seconds: The Evolution of Real-Time DNS Intelligence 📍 INCYBER Demos Stage, INCYBER Forum 🕒 Thursday, 02 April, 2026 2:00 PM to 2:30 PM · 30 min. (Europe/Paris)

We’re thrilled to announce our new MCP server, enabling you to access DomainTools intelligence directly within your AI workflows. Learn more today: http://www.domaintools.com/press/domaintools-launches-mcp-server-connecting-ai-agents-directly-to-20-years-of-domain-intelligence

Shift your posture from reactive to proactive at #BHA2026. 🇸🇬 With DomainTools, your team can: ✅ Automate the hunt ✅ Contextualize alerts ✅ Get more from your existing stack Meet us in Singapore ➡️ https://www.domaintools.com/events/black-hat-asia#BHA2026 #BlackHatAsia #ThreatIntel

This "ChatGPT Ad Blocker"🚧 extension is a data-harvesting tool. It clones your ChatGPT conversations and sends them to a Discord webhook. Learn more: https://dti.domaintools.com/securitysnacks/securitysnack-openai-anti-ads-malware #CyberSecurity #ChatGPT #DataPrivacy #Infosec

Planning your #FIC2026 schedule? Stop by the DomainTools booth # G49 for a live demo and a quick conversation with our team. We’re happy to meet over a coffee ☕nearby – or connect virtually if you can’t make it.

The DomainTools team is at #RSAC2026 holding meetings at Spaces. In case you missed it, you can still schedule a meeting with us at the link here: https://www.domaintools.com/events/rsac-2026

Make your security tools work smarter not harder. 🛠️ At #RSAC, we’re sharing how DomainTools data integrates with your SIEM, SOAR, and even LLM solutions to reduce cyber risk and boost efficiency. Sign up to meet our product team ⬇️ https://www.domaintools.com/events/rsac-2026#RSAC

🔑New from DTI: Technical breakdown of the TLS private key exposure for Qihoo 360’s "Security Claw" AI Platform. Read more here: https://dti.domaintools.com/research/exposure-of-tls-private-key-for-myclaw-360-in-qihoo-360-security-claw-ai-platform #CyberSecurity #ThreatIntel #AI #InfoSec

We’re looking forward to #FIC2026 and connecting with the security community. At DomainTools, we’re focused on bringing Real-Time risk data into the tools teams already use – from SIEM/SOAR to emerging LLM security workflows. Lets connect in Lille 👇 https://calendar.app.google/eNsysJgTdz7b4ab56#FIC2026

Heading to #RSAC 2026? 🌉 Let’s grab 10 minutes to discuss how our DNS infrastructure analysis keeps you ahead of the curve. Book a coffee chat here ⬇️ https://www.domaintools.com/events/rsac-2026#RSAC

New SecuritySnack: How attackers are abusing CloudFlare to hide M365 phishing campaigns. 🛡️➡️⚔️ Read the technical breakdown here: https://dti.domaintools.com/securitysnacks/securitysnack-cloudflare-anti-security-for-phishing #CyberSecurity #Phishing #CloudSecurity #Infosec

We’re heading back to Lille for #FIC2026 🇫🇷 Catch us on April 2 at 2:00 PM to see how security teams are getting real-time insight into malicious infrastructure and staying ahead of attackers. 📅 Book time: https://calendar.app.google/eNsysJgTdz7b4ab56#FIC2026

Stop responding to threats and start predicting them. 🛑 Find us at #RSAC to see how our new Real-Time Threat Feeds can help you identify malicious infrastructure before it’s weaponized. Schedule a meeting with the DomainTools team in SF ⬇️ https://www.domaintools.com/events/rsac-2026#RSAC

One last February note 💌 The latest Daniel Schwalbe newsletter is here, featuring the DTI team’s latest analysis! Read it here👇 https://dti.domaintools.com/newsletters/fourteen-newsletters-and-fifteen-winters

📰DTI’s latest research dives into the dev-ops of disinformation campaigns. Read our investigation into the Doppelgänger / RRN disinformation ecosystem here 👇https://dti.domaintools.com/research/doppelganger-rrn-disinformation-infrastructure-ecosystem #Cybersecurity #Disinformation #InfoSec

From fake BTC “doublers” to wallet-draining presale sites, DTI uncovered a crypto scam network spanning ~250 domains impersonating public figures like Elon Musk and President Donald Trump. Read the investigation ⬇️ dti.domaintools.com/securitysnac... #Cybersecurity #Scams #Crypto #Infosec

🪷 The Petals of Espionage: DomainTools Investigations’ latest research analyzes the “who”, “how”, and “why” behind Lotus Blossom’s compromise of Notepad++. Read the investigation: https://dti.domaintools.com/research/lotus-blossom-and-the-notepad-supply-chain-espionage-campaign

It’s Day # 2 of #AFCEAWest, and DomainTools Federal is here at the San Diego Convention Center. Stop by Booth # 2309 to talk to our team about how we give you the offensive edge against state sponsored adversaries. #CyberDefense #ThreatHunting #Federal #DomainTools

DomainTools Federal is at #AFCEAWest at the San Diego Convention Center! Stop by Booth # 2309 to learn how we’re giving bad actors more bad days.

January has come to a close, which means Daniel Schwalbe's newsletter is live! Get caught up on all our DTI team has been up to this last month 👇https://dti.domaintools.com/newsletters/thirteen-silver-newsletters