Threat intelligence / Technique

Domains

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes (see [ATT&CK](https://attack.mitre.org/techniques/T1583/001/)). Large AI datasets are often distributed as a list of URLs to individual datapoints. Adversaries may acquire expired domains that are included in these datasets and replace individual datapoints with poisoned examples ([Publish Poisoned AI Artifacts: Datasets](/techniques/AML.T0115.000)).

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes (see [ATT&CK](https://attack.mitre.org/techniques/T1583/001/)). Large AI datasets are often distributed as a list of URLs to individual datapoints. Adversaries may acquire expired domains that are included in these datasets and replace individual datapoints with poisoned examples ([Publish Poisoned AI Artifacts: Datasets](/techniques/AML.T0115.000)).

4 recorded

Relationships

subtechnique-of

to Acquire Infrastructure

Technique

uses

from AI in the Middle: Web-Based AI Services as C2 Relays

Campaign

uses

from Supply Chain Compromise via Poisoned ClawdBot Skill

Campaign

uses

from Web-Scale Data Poisoning: Split-View Attack

Campaign

1 external

References

mitre-atlas

AML.T0008.002