The website ddd[.]com claims to be a domain registrant and manager, and even if it is - we definitely wouldn't trust this one. Our Security Research team came across this domain while reviewing customer logs, and saw an unusual amount of communications blocked from this domain.

A simple Google search shows results for a "domain manager", with a description written in substandard English and no other information or referrals. Interestingly, the domain has 0/85 malicious detections on VirusTotal by the various threat intelligence and security companies the platform works with, yet the IOC's profile indicates dozens of malicious files related to the domain (files deemed malicious by a VT source are colored red).

 

vt detections

vt graph

Images: VirusTotal

 

This peculiar service has also been related to various types of threats over the last few years on AlienVault's Open Threat Exchange, such as mobile information stealers and malware, data breaches, and the MyDoom malware family. In addition to all the suspicious characteristics mentioned above, ddd[.]com is registered on GoDaddy, which - as we all know by now - has a higher chance of serving up something really bad vs something good compared to other registrars. 

 

otx

Image: OTX

 

This domain has been active for the last two years in our ThreatSTOP Originated - Core Threats target, a blocklist made up of domains that our Security Research team has determined are a current active threat, that have not shown up in any other threat intelligence feed. This target includes malware droppers, botnet C&Cs, exploit kits, information on trending APT attacks and more. ThreatSTOP analysts build this target by monitoring and analyzing new malware and attacks, and swiftly adding their indicators into our systems, which are propagated to user devices in real time.

 

ThreatSTOP checkioc

Image: ThreatSTOP CheckIOC

 

ThreatSTOP recommends taking caution and blocking domains like this. Especially after seeing tons of connection attempts between our customer networks and this bad domain, we can truly say that if a domain looks like it's up to no good, and it won't cripple anyone's work if you block it, do yourself a favor and protect your devices and employees from impending threats.

 

Ready to try ThreatSTOP in your network? Want an expert-led demo to see how it works?

Get a Demo