Recorded Future Typosquat Alert Handling

Template playbook showing suggested steps to triage typo squat alerts. Classifier/Mapper are available to ingest Recorded Future Typo squat Alerts.

Recorded Future Intelligence · 14 tasks · 1 input · 0 outputs

Inputs

  • domain —

Commands used

cen-search ip recordedfuture-links url whois

Flowchart

YES Start Start Dig Command - Check 'A' Record - Dig Dig Command - Check 'A' R... Dig Research any certificates (censys.io search) - cen-search Research any certificates... cen-search Utilize DomainTools (domain-profile) Utilize DomainTools (doma... Check for website brand abuse (urlscan.io) - url Check for website brand a... url Suspicious Based on Evidence? Suspicious Based on Evide... Initiate Takedown / Prevent MX Communication Initiate Takedown / Preve... Whois Lookup (ip) - ip Whois Lookup (ip) ip IP Reputation lookup - ip IP Reputation lookup ip Whois Lookup (domain) - whois Whois Lookup (domain) whois Technical Links - recordedfuture-links Technical Links recordedfuture-links Review any parent/sibling domains Review any parent/sibling... Enrich parent/sibling domains Enrich parent/sibling dom... Done Done