# dns sluth

```
A suspicious phishing email claimed to come from support-hackorn.secpen.org - as reported. Goal: Identify the suspicious subdomain that briefly existed.

Link : dns_sluth.zip

Sample: SPL{sone_random_text}
```

The hostname `support-hackorn.secpen.org` only appeared once:

```
2025-05-14T01:00:00,support-hackorn.secpen.org,192.168.43.68
```

Flag: `support-hackorn.secpen.org`.