Domain Renown/Categorization

Adversaries may acquire domains for targeting and operations such as phishing, drive-by compromise, and command and control. They may select look-alike names using typosquatting, homoglyphs or internationalized domain names, and alternate top-level domains; repurpose expired domains whose history may leave them trusted or allowlisted by some defenders; vary or privacy-protect registration details; or register domains in a compromised cloud environment such as AWS Route 53. Domain acquisition alone does not establish that a web, mail, or command-and-control service has been configured.