Lion Cipher Lab

Enrich proxy-log domains with RDAP registration age, then measure whether the signal is worth an alert

• Threat Intel Analyst
• Intermediate
• ~90 min
• Free · no account required

Why it matters

Every SOC eventually hears the rule of thumb 'newly registered domains are bad', and every SOC is tempted to turn it straight into an alert. Phishing and malware infrastructure often is young, because attackers register fresh domains for each campaign and abandon them when they get blocked. But a rule of thumb is not a detection. Your marketing team launches a new campaign domain, a team signs up for a new SaaS tool, and a domain that is ten years old gets compromised and starts serving malware. The only way to know whether age is worth an alert in your environment is to enrich the domains…

What you'll learn

• what RDAP is (the structured JSON successor to port-43 WHOIS) and how to find the right RDAP server for any domain with the IANA bootstrap file
• reading an RDAP domain answer: the events array, the 'registration' eventAction, error answers and the redacted member
• writing a bulk enricher in standard-library Python that turns a proxy log into one registration age per domain
• computing a domain's age at the moment you saw it, not today, and measuring how much the wrong choice costs
• scoring age thresholds (under 7, 30 and 90 days) with precision, recall and alert volume against labelled data
• combining age with one cheap second feature (how many internal clients touched the domain) and measuring the trade it buys
• deciding what to do with domains whose age you could not get, instead of letting them silently pass or flood the queue
• knowing where the signal breaks: old compromised domains, ccTLDs with no RDAP server, rate limits, redaction and caching

Steps in this lab

1. What this lab does that its neighbours do not
2. The words you need: RDAP, WHOIS, registry, registrar, bootstrap, events
3. Optional: one live RDAP lookup, bootstrap first
4. Generate the labelled dataset (offline, same for everyone)
5. Read three fixtures before you write any code
6. Write the enricher: bootstrap, first sighting, age at observation
7. Run it and read the coverage line first
8. Measure the mistake: age from today instead of age when seen
9. Add one cheap feature and measure what it buys
10. Decide what 'age unknown' means before it decides for you
11. What age can never see, and where the data itself lies
12. The caveats this dataset cannot show you
13. When to use it, why it works, and how to do it better

Open the full interactive lab →