T1583.001: Domains
Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control.CitationCISA MSS Sep 2020 Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).CitationFireEye APT28CitationPaypalScam Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.CitationCISA IDN ST05-016Citationtt_httrack_fake_domainsCitationtt_obliqueRATCitationhttrack_unhcrCitationlazgroup_idn_phishing
Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).CitationiOS URL SchemeCitationURICitationURI UseCitationURI Unique
Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.CitationCategorisation_not_boundaryCitationDomain_Steal_CCCitationRedirectors_Domain_FrontingCitationbypass_webproxy_filtering
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.CitationMandiant APT1
In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.CitationInvictus IR DangerDev 2024
Security context for executives and security teams
Domain acquisition matters because it happens before the obvious intrusion. Adversaries can buy, obtain, or re-register domains to make phishing, drive-by compromise, and command-and-control infrastructure look believable or trusted. The business issue is not just “bad domains”; it is whether the organization can spot lookalike brands, expired trusted domains, suspicious new infrastructure, and unauthorized domain activity in cloud environments before users, partners, or controls trust them.
Executive priority
Treat this as a pre-compromise visibility and governance problem. Leaders should ask who owns domain risk across brand protection, DNS operations, cloud security, email/web filtering, and incident response. Priority should go to evidence that the organization monitors lookalike and expired domains, controls domain registration capability in cloud services such as AWS Route53, and can explain how domain intelligence influences phishing, web, and C2 investigations.
Technical view
ATT&CK places T1583.001 under Resource Development on the PRE platform, as a sub-technique of Acquire Infrastructure. MITRE provides no official detection text, but the related DET0892 detection strategy indicates domain-focused detection is relevant. SOC and detection teams should validate coverage for newly registered, re-registered, homoglyph/IDN, alternate-TLD, and dynamically generated URI/domain patterns, especially where they intersect with phishing, drive-by compromise, or command-and-control investigations. IR teams should also check cloud audit evidence for domain registration or hosted-zone creation in compromised environments, specifically the Route53 scenario described by MITRE.
Likely telemetry
- Domain registrar and WHOIS registration records, including private WHOIS indicators where available
- DNS resolution and passive DNS history for suspicious, re-registered, or lookalike domains
- Email security telemetry containing URLs and domains used in phishing delivery
- Web proxy or secure web gateway logs for user visits to suspicious domains and unique URLs
- Cloud control-plane audit logs for AWS Route53 domain registration and hosted-zone creation
Detection direction
- Validate DET0892-aligned domain detection against lookalike domains, homoglyphs, internationalized domain names, alternate TLDs, and typosquatting patterns.
- Tune detections to account for legitimate brand, marketing, and third-party domain registrations to reduce false positives.
- Review whether web and email controls over-trust domains based only on historical reputation, since MITRE notes expired or re-purposed domains may retain trusted status.
- Correlate suspicious domain observations with phishing, drive-by compromise, and command-and-control cases rather than treating domain registration as a standalone signal.
- In AWS environments, alert on unusual Route53 domain registration or hosted-zone activity, especially from identities or accounts that do not normally manage DNS.
Mitigation priorities
- Implement pre-compromise controls consistent with M1056: reduce exposed and abusable domain-related attack surface and identify adversary preparation activity early.
- Maintain governance over owned, expired, and business-critical domains so abandoned domains do not become trusted attacker infrastructure.
- Restrict and monitor who can register domains or create hosted zones in cloud environments such as AWS Route53.
- Use domain intelligence to inform email, web, and incident response workflows, with special attention to lookalike, IDN, homoglyph, and re-registered domains.
- Periodically test whether allowlists and reputation-based controls can be bypassed by trusted-looking or previously reputable domains.
Additional notes and limits
This technique is widely connected in ATT&CK relationships to campaigns and groups, including CostaRicto, Operation Spalax, Operation Honeybee, FunnyDream, Operation Dream Job, Operation Ghost, SolarWinds Compromise, APT1, APT28, Lazarus Group, Sandworm Team, Dragonfly, and others. That relationship context supports the importance of domain acquisition as a common preparatory behavior, but it should not be read as evidence that any specific organization is currently targeted.
MITRE provides no official detection procedure for this object, and the related DET0892 strategy details were not supplied. Local conclusions require environment-specific evidence: registrar data access, DNS visibility, email/web logging, cloud audit coverage, allowlist practices, and knowledge of legitimate domain registration workflows.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Domains
Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control.CitationCISA MSS Sep 2020 Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).CitationFireEye APT28CitationPaypalScam Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.CitationCISA IDN ST05-016Citationtt_httrack_fake_domainsCitationtt_obliqueRATCitationhttrack_unhcrCitationlazgroup_idn_phishing
Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).CitationiOS URL SchemeCitationURICitationURI UseCitationURI Unique
Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.CitationCategorisation_not_boundaryCitationDomain_Steal_CCCitationRedirectors_Domain_FrontingCitationbypass_webproxy_filtering
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.CitationMandiant APT1
In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.CitationInvictus IR DangerDev 2024
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.