Adversaries, especially APT groups, routinely stand up infrastructure on domains registered days or hours before an operation begins. By the time a domain shows up on a reputation blocklist, the campaign may already be underway. This talk introduces NRD-db, an open-source Docker/Redis pipeline that ingests newly registered domains then feeds that intelligence directly into Arkime’s WISE tagging.

I’ll cover the architecture, then demo it live: recognizing a newly-registered domain in Arkime sessions and pivoting through existing enrichment data tools to assess it as a potential APT staging point.

Takeaways: a deployable open-source tool and a practical WISE integration pattern for anyone running network security monitoring or threat hunting with Arkime. Aimed at analysts and engineers from beginner to advanced.

github.com/StrackVibes/NRD-db

In this presentation we will go over, “What is JA4+?”

And how to use JA4+ to identify:

• Suspicious/malicious connections through residential proxies and VPNs
• Bots
• AI agents and scrapers
• Exploit tools
• DDoS tools
• Malware
• Devices and software on the network
• Malicious servers / C2s on the Internet
• Reverse SSH shells

We’re basically going to show you how to solve the internet in about 45 minutes.