Analyzing a suspicious domain

1 Introduction

A domain name is the human-readable address of a website -- like google.com or amazon.com. Attackers register domains that look trustworthy to trick victims into visiting malicious websites, entering credentials, or downloading malware.

Think of it like a storefront. A legitimate business has a proper name, a real address, and has been around for years. A suspicious store appears overnight, has a name that copies a famous brand with a slight twist, and vanishes within weeks. Learning to spot these suspicious domains is a fundamental cybersecurity skill.

Key indicators of a suspicious domain

Recently created

Registered days or weeks ago

Random characters

xk7t9-login.com

Typosquatting

amaz0n.com, gogle.com

2 How It Works

Use the domain analyzer below to investigate any suspicious domain and see its registration details, DNS records, and risk indicators.

WHOIS: the domain's identity card

Every domain registration creates a WHOIS record -- a public database entry containing the creation date, registrar, name servers, and sometimes the owner's contact information. This is the first thing analysts check when investigating a domain.

Creation date

A domain created just days ago is far more suspicious than one that has been active for years. Attackers register domains shortly before launching campaigns.

Privacy protection

While privacy services are used by legitimate owners, attackers always hide behind them. A hidden WHOIS combined with other red flags raises the risk level.

Registrar

Some low-cost registrars with weak abuse policies are favored by attackers. Seeing a domain on such a registrar alongside other indicators is concerning.

Name servers

Legitimate businesses use established DNS providers. Attackers may use free or disposable DNS services, or hosting known for bulletproof operations.

3 Detailed Analysis

Typosquatting techniques

Typosquatting is the practice of registering domain names that are slight misspellings of popular websites. Attackers count on users making typing mistakes or not noticing subtle differences:

Technique	Legitimate	Typosquat	Trick
Character swap	google.com	gooogle.com	Extra letter
Number substitution	paypal.com	paypa1.com	Letter "l" replaced by "1"
TLD swap	amazon.com	amazon.org	Different extension
Hyphen insertion	microsoft.com	micro-soft.com	Added hyphen

Domain Generation Algorithms (DGA)

Some malware uses Domain Generation Algorithms to create hundreds of random-looking domain names every day. The malware tries to connect to these domains, and the attacker only needs to register one of them to maintain control. These domains look like random strings:

xk7t9m2p.com

b3qr8w5n.net

j9fy2k4d.org

m6hz1v8c.info

If you see a domain that looks like a random string of characters, it is very likely generated by a DGA and associated with malware command-and-control infrastructure.

Try it on mlab.sh

Investigate any domain by checking its WHOIS registration, DNS records, SSL certificate, and creation date. Spot the red flags you just learned about on real domains.

Investigate a domain on mlab.sh

4 Red Flags

Here are the warning signs that a domain may be malicious:

Created less than 30 days ago

The majority of phishing domains are used within days of registration and abandoned shortly after. A brand-new domain asking for credentials is highly suspicious.

Looks like a known brand but is not

Domains like apple-id-verify.com or netflix-billing-update.net impersonate trusted brands to steal credentials.

Random string of characters

Domains made up of random letters and numbers are typically generated by malware (DGA) or used for short-lived phishing operations.

Unusual TLD

Extensions like .xyz, .top, .buzz, or .click are cheap and popular among attackers. A bank will never use these TLDs.

Hidden WHOIS with other red flags

Privacy protection alone is not suspicious, but when combined with a new domain, a cheap TLD, and a brand-name imitation, it becomes a clear warning sign.

No web content or just a login page

A domain that hosts nothing but a single login form mimicking a known service is almost certainly a phishing page designed to harvest credentials.

Related Modules

What is a domain?

Human-readable names: how domains translate IP addresses into easy-to-remember names.

What is DNS?

The Internet's phone book: how DNS translates domain names into IP addresses.

Recognizing a phishing link

Techniques for detecting fraudulent URLs that mimic legitimate websites.