AVL Code
All cases
#022 · Threat Assessment

Threat Assessment of a Typosquatted Ministry-of-Public-Security Domain

To thoroughly assess a government-impersonating phishing domain, analysts drove AVL Code with a single natural-language instruction, closing the loop from domain input to a complete threat-assessment report.

Built with AVL Code + the Landi model

Impersonating WebsiteTyposquattingGovernment Domain SpoofingThreat AssessmentDomain Analysis

Overview

Facing the malicious domain msp.gov.cn.poliec.com, which impersonates a Chinese Ministry of Public Security (MPS) government domain, analysts drove AVL Code with one natural-language instruction to conduct a full threat assessment: identifying its compound disguise of typosquatting (poliec.com is an i/e-swapped misspelling of police.com) plus government-subdomain grafting (msp.gov.cn imitates the MPS's official domain, mps.gov.cn), checking domain registration data (registered via NameSilo, PrivacyGuardian privacy protection, only 2.5 months old) and DNS configuration (only dnsowl.com authoritative NS records configured, no A/MX records), and confirming the domain has been jointly flagged as fraudulent by China's National Anti-Fraud Center, the MIIT Anti-Fraud Center and China Unicom — visiting it triggers an official fraud-warning page operated by the China Academy of Information and Communications Technology. It completed a 7-dimension risk assessment and, in about 10 minutes, produced a report with a complete IOC list, threat-intelligence correlation and a three-tier remediation plan, classifying the domain as high-confidence malicious.

Key results

  • Fully assessed the MPS-impersonating government domain msp.gov.cn.poliec.com, identifying its compound disguise of typosquatting plus government-subdomain grafting
  • Checked domain registration and DNS configuration — NameSilo registrar, PrivacyGuardian privacy protection, only 2.5 months old, only dnsowl.com authoritative NS configured with no A/MX records
  • Confirmed the domain has been jointly flagged as fraudulent by the National Anti-Fraud Center, the MIIT Anti-Fraud Center and China Unicom, with visits triggering an official fraud-warning page operated by the China Academy of Information and Communications Technology
  • Completed a 7-dimension risk assessment and extracted a complete IOC list (1 impersonating domain, 3 name servers, 1 registrar, 1 privacy-protection service), producing a three-tier remediation plan in about 10 minutes, classified as high-confidence malicious

Technical highlights

Typosquatting detectionGovernment-subdomain grafting analysisDomain registration verificationIn-depth DNS resolution analysisOfficial anti-fraud flag verificationMulti-source threat-intelligence correlationComposite risk-assessment matrix

Practical value

Helps security operations teams rapidly identify and respond to government-impersonating website threats, provides end-to-end guidance from detection to remediation, strengthens detection of phishing sites and fraudulent domains, and effectively protects users from government-agency impersonation scams.

Artifacts

View session Download session import into your workspace for full detail View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model