Suspicious Domain Monitor

Real-time monitoring and risk analysis of newly registered domains using open threat intelligence sources.

🚀 Overview

Suspicious Domain Monitor is a web-based threat intelligence dashboard that tracks newly registered domains and automatically scores them for potential malicious intent.
It is designed for SOC analysts, blue teams, researchers, and OSINT practitioners who want early visibility into phishing, malware, and scam infrastructure.

The system currently ingests data from the ISC SANS Recent Domains API, applies heuristic risk scoring, and provides quick external analysis links.

---

✨ Features

🔍 Domain Monitoring

• Fetch all newly registered domains from ISC SANS
• Cached fetches to reduce API load (10-minute cache)
• Handles large datasets (170k+ domains/day)

⚠️ Risk Classification

• Low / Medium / High / Critical risk levels
• Numeric risk score (0–10)
• Color-coded severity indicators

📊 Dashboard Metrics

• Total domains monitored
• Counts by risk category
• Real-time update timestamp

🔎 Search & Exploration

• Instant client-side domain search
• Paginated results for large datasets
• Per-domain analysis shortcuts:
  • VirusTotal
  • URLScan
  • Screenshot (thumbnail)

🌐 100% Open Data

• No proprietary feeds required
• Fully OSINT-friendly

---

🧠 Risk Scoring (Current)

Domains are scored using lightweight heuristics such as:

• Suspicious keywords
• Numeric-heavy patterns
• TLD reputation
• Domain length and entropy
• Newly registered status

⚠️ Scores are indicators, not verdicts — always validate before taking action.

---

🛠️ Tech Stack

• Frontend: HTML, CSS, JavaScript
• Backend: Lightweight API / serverless compatible
• Data Source: ISC SANS Recent Domains API (JSON)
• Deployment: Any static + API-compatible hosting

---

📦 Install and Run

git clone https://github.com/kiranphilip/domains.git
cd domains/backend
npm init -y
npm install express cors axios
node server.js
cd ..
python -m http.server 8080 --bind 0.0.0.0

🧪 Usage

1. Open http://localhost:8080 in your web browser
2. Click Fetch All Domains
3. Wait for initial ingestion (10–20 seconds)
4. Filter or search suspicious domains
5. Use external tools for deeper inspection

---

🧭 Roadmap

• Advanced heuristics
• Historical trend analysis
• Export & alerting
• IOC correlation

---

⚠️ Disclaimer

This tool is for research and defensive security purposes only.
No guarantees are made about domain maliciousness.

---

📄 License

MIT License