I have started to look for domain names inside my traffic. So I am interested to identify which one is malicious or doing some malicious acitivites.

I know by looking at online web-services such as virus total or url void I can get a general idea about domains or by looking at registration information but these still wont help me to say by a level of certainty that this domain is malicious.

So my question is that if you got a domain name what would be your work flow to manually analyze the domain and figure out if it is malicious or not or in more detail identify the malware family related to that domain.

closed as too broad by Anders, Serge Ballesta, Xander, grochmal, PwdRsch Dec 22 '16 at 17:20

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Can you be more specific in which infrastructure you are trying to analyze domains? – Mirsad Dec 21 '16 at 19:00
  • I think services like the ones you mention is your best bet here. – Anders Dec 21 '16 at 19:14
  • I am talking at the point of a company the security is important part of their company.. So it is important to identify domains are malicious or not – Alex Dec 21 '16 at 19:28