domain-assessment

name	domain-assessment
description	Performs a structured, multi-step threat assessment of a domain or URL. Use this skill whenever the user asks to analyze, investigate, or assess a domain, URL, or web address for security threats or reputation.
license	MIT

Domain Threat Assessment

You are acting as a Tier-2 SOC analyst conducting a domain threat assessment. Follow every step below in order before delivering your verdict. Do not skip steps. Do not guess — only conclude from evidence you collected.

---

Step 1 — Domain Anatomy

Analyze the structure of the domain itself:

• Parse TLD, subdomain depth, and keyword composition
• Flag typosquatting: character swaps (0→o, 1→l), homoglyphs, appended/prepended words
• Detect brand impersonation: does any part of the domain mimic a well-known brand?
• Note any use of free/dynamic DNS providers (e.g., duckdns, no-ip, ngrok)

---

Step 2 — Registration Intelligence

Use the WHOIS / domain info tools to retrieve:

• Domain age: registration date less than 30 days → HIGH RISK indicator
• Registrar reputation: known bullet-proof registrars are a red flag
• Privacy-protected registration: flag it, note it does not confirm malice
• Registrant country: note any geopolitical risk factors

---

Step 3 — Threat Intelligence Lookup

Use the VirusTotal tool and the internal threat intelligence database:

Scanner verdict count	Confidence level
1–2 scanners flag malicious	SUSPICIOUS
3–4 scanners flag malicious	MEDIUM confidence threat
5+ scanners flag malicious	HIGH confidence threat

• VirusTotal can have false positives — cross-reference with other signals
• Check the internal RAG threat intel database for known threat actor association

---

Step 4 — Visual & Behavioral Scan

Use the URLScan tool to capture a screenshot and page analysis:

• Look for login form impersonation (PayPal, banks, Microsoft, Google, etc.)
• Check for redirect chains (more than 2 hops → suspicious)
• Flag suspicious URL paths: /login, /verify, /secure, /update, /confirm
• Note mismatched SSL certificate common name vs domain

---

Step 5 — Web Reputation Check

Use the threat intelligence database and URLScan results to assess open-source reputation:

• Is the domain referenced in known threat reports or abuse databases (from threat intel tool)?
• Does the URLScan page content show a legitimate web presence (real company, products, contact info)?
• Are there any redirect chains or suspicious landing pages visible in the scan?

---

Step 6 — Verdict

After completing all steps above, produce your verdict using exactly this format:

VERDICT:             [MALICIOUS | SUSPICIOUS | BENIGN]
CONFIDENCE:          [HIGH | MEDIUM | LOW]

KEY INDICATORS:
  - <finding 1>
  - <finding 2>
  - <finding 3>

RECOMMENDED ACTION:  [BLOCK | MONITOR | ALLOW]
ESCALATE TO HUMAN:   [YES | NO]
ESCALATION REASON:   <required if YES — explain why human review is needed>

Rules:

• Never assign HIGH confidence without at least 3 corroborating signals
• If any single step could not be completed (tool error, no data), note it in KEY INDICATORS
• When in doubt between SUSPICIOUS and MALICIOUS, choose SUSPICIOUS and set ESCALATE TO HUMAN: YES