What suspicious domain was identified in the exercise?

• A. example.com
• B. not-detected.io
• C. dataexfiltration.example
• D. dataexfil[.]com

Answer: (D)

The key signal is a domain that directly hints at exfiltration and uses an obfuscated dot. dataexfil[.]com combines the idea of data exfiltration with a bracketed dot, a common tactic to dodge simple filters and make the domain look suspicious in logs or training data. This combination makes it the clear indicator of a potentially malicious exfiltration domain in the exercise. The other domains are either generic placeholders or conventional-looking domains that don’t carry the same explicit exfiltration cue.