AVL Code
All cases
#022 · Threat Assessment

Case study · Threat Assessment

Threat Assessment of a Typosquatted Ministry-of-Public-Security Domain

A security operations analyst receives a suspicious domain spoofing an MPS government portal and drives AVL Code with a single natural-language instruction to split the task and dispatch three sub-agents in parallel; about 10 minutes later a complete assessment report lands with the IOC list, a 7-dimension risk assessment and a three-tier remediation plan, with the domain rated malicious at high confidence.

Target: a single suspicious domain, msp.gov.cn.poliec.com· Method: 1 instruction → 3 parallel sub-agents· Model: AVL-Zero · Landi N2.5· Deliverable: complete threat-assessment report (Markdown)· Duration: parallel assessment 5m0s · about 10 minutes end to end

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Task decomposition — one assessment instruction splits into 4 sub-tasks

    You hand AVL Code the suspicious domain and watch it split "full-dimension threat assessment" into four jobs — domain registration checks, page malicious-trait detection, threat-intel correlation, report integration — and dispatch 3 sub-agents to run them in parallel.

  2. 02

    Parallel assessment — three evidence lines run inside a 5-minute window

    The three sub-agents verify domain registration and DNS basics, page malicious traits and threat-intel correlation in parallel, returning results (4m21s / still running / 4m36s) without blocking one another.

  3. 03

    Integration and review — high-confidence malicious verdict with three-tier remediation

    The main agent integrates the three tracks into a complete assessment report for your review: official anti-fraud flagging, a combined spoofing technique, a 7-dimension risk assessment, the IOC list and P0/P1/P2 remediation advice.

Task for AVL Code

Run a full-dimension threat assessment of the spoofed domain msp.gov.cn.poliec.com and produce the complete assessment report

Plan: ① first split the task into 4 sub-tasks — domain registration checks, page malicious-trait detection, threat-intel correlation analysis, report integration → ② dispatch 4 sub-agents in parallel for the sub-tasks → ③ integrate the results into a complete assessment report for my review

Prerequisites: AVL Code is available and the domain to assess is in hand. No need to visit the domain yourself — the official anti-fraud warning page is fetched automatically during the assessment, avoiding direct interaction with the suspicious site

Reproduction materials at the end of this article Try it yourself ↓

Task Decomposition

The assessment opens by splitting "full-dimension" into parallel-executable sub-tasks:

You type → AVL Code 
Run a full-dimension threat assessment of the spoofed domain msp.gov.cn.poliec.com and produce the complete assessment report

Plan: ① first split the task into 4 sub-tasks — domain registration checks, page malicious-trait detection, threat-intel correlation analysis, report integration → ② dispatch 4 sub-agents in parallel for the sub-tasks → ③ integrate the results into a complete assessment report for my review
AVL Code runs → you see
Splits into 4 sub-tasks: domain registration checks · page malicious-trait detection · threat-intel correlation · report integration
→ Dispatches 3 sub-agents to run them in parallel

Parallel Assessment

Three evidence lines run inside a 5-minute window without blocking one another:

You type → AVL Code 
(the same instruction still running, no new input)
AVL Code runs → you see
Domain registration and DNS basics (4m21s) · page malicious traits (running) · threat-intel correlation (4m36s)
→ The official anti-fraud warning page is fetched automatically during the assessment, avoiding direct interaction with the suspicious site

Integration and Review

The main agent integrates the three tracks into a complete assessment report ready for a ticket:

You type → AVL Code 
(the same instruction still running, no new input)
AVL Code runs → you see
Combined spoofing: Typosquatting (poliec.com ↔ police.com transposition) + mps.gov.cn government sub-domain grafting
→ Registration: NameSilo · PrivacyGuardian privacy protection · registered only 2.5 months · dnsowl.com authoritative NS only, no A/MX records
→ Flagged as a fraud website jointly by the National Anti-Fraud Center, MIIT Anti-Fraud Center and China Unicom
→ 7-dimension risk assessment · IOC list · P0/P1/P2 three-tier remediation

Try it yourself

The whole task is one instruction; swap <suspicious domain> for your own target to reproduce:

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report 
Run a full-dimension threat assessment of the spoofed domain <suspicious domain> and produce the complete assessment report
  • Limitation: this session export is the folded view — the sub-agents’ internal tool-call sequences and the raw Whois/DNS returns are not expanded, so the process cannot be replayed call by call. Two sources disagree on the authoritative NS attribution (Cloudflare DNS in the session body vs dnsowl.com in the assessment report / the existing entry); the assessment report is authoritative.

Next question: The P2 remediation advice points at the detection side — converting the IOC list into NIDS/SIEM detection rules and verifying alert coverage is the natural next task after this assessment.