Domain Name: Data Point Intelligence Guide

A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean. Every registration leaves a paper trail, and every resolution leaves a network trail.

Understanding the Domain Name as an intelligence artifact

A domain name is a human-readable label in the Domain Name System that resolves, through a delegated hierarchy of nameservers, to network resources. Structurally it is a label plus an effective top-level domain, governed by the Public Suffix List rather than by simple dot counting. Behind it sits a registry, a registrar, a registrant record and a set of authoritative nameservers. Fundamentally a domain represents a leased identity: someone paid money, at a moment in time, through an intermediary, to control a namespace. That transaction and that control are both observable.

Analytically the important variants are internationalised domains encoded as Punycode, which enable homoglyph impersonation; new gTLDs and cheap ccTLDs favoured for disposable infrastructure; and dynamic DNS labels where the registrant controls only a subdomain of a shared parent. Wildcard records, parked pages, and registrar-held expired inventory all change what a resolution actually proves about ownership.

Why it matters

A domain is the highest-yield starting pivot in most investigations because it links three otherwise separate worlds: registration data, DNS resolution history, and TLS certificate issuance. From one domain you can reach the hosting IP, the certificate serial and its sibling names, the mail infrastructure, the registrar and abuse contact for takedown, and passive DNS records showing every host the domain ever pointed at. It is also the artifact victims see, so it anchors phishing and brand-abuse reporting.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Registration and expiry dates from RDAP, where a domain created within days of first observed abuse indicates purpose-built rather than compromised infrastructure.
Registrar and reseller identity, which predicts abuse-response speed and often clusters actors who buy in bulk from the same low-cost provider.
Authoritative nameserver set, frequently more stable than hosting IPs and a strong clustering key across an actor estate.
Passive DNS resolution history showing IP churn, fast flux behaviour, or a single long-lived host shared with unrelated tenants.
Certificate transparency entries revealing subdomains, issuance cadence, and sibling domains listed in the same subject alternative name set.
Mail posture from MX, SPF, DKIM and DMARC records, distinguishing a domain built to send mail from one registered only to host a landing page.
Lexical structure such as keyword stuffing, hyphenation, brand substrings and Punycode encoding, which feeds typosquat and homoglyph detection.
Nameserver or registrar changes over time, which often precede a campaign relaunch after a takedown.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

RDAP (registry and registrar endpoints) — Structured, authoritative registration data: creation and expiry dates, registrar, status codes, abuse contacts.
WHOIS history services (WhoisXML, DomainTools) — Pre-redaction registrant records and historic ownership changes that current RDAP output no longer shows.
crt.sh and Certificate Transparency logs — Every publicly logged certificate for the domain, exposing subdomains and sibling names on shared certificates.
SecurityTrails or Farsight DNSDB passive DNS — Historic A, MX and NS resolutions showing where the domain pointed and when it moved.
urlscan.io — Rendered page captures, redirect chains, loaded resources and screenshots for domains seen in the wild.
VirusTotal — Aggregated vendor verdicts, resolution history, referring files and communicating samples tied to the domain.
abuse.ch URLhaus and ThreatFox — Community-reported malicious URLs, payload delivery hosts and C2 domains with malware family attribution.
Public Suffix List — Authoritative boundary between registrable domain and subdomain, needed for correct grouping and deduplication.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Normalise the input — Lowercase, strip trailing dots, decode Punycode to Unicode and back, and derive the registrable domain using the Public Suffix List before any lookup.
Pull registration data — Query RDAP at registry and registrar level for creation date, status codes, nameservers and abuse contact, then check historic WHOIS for pre-redaction registrant detail.
Resolve and record DNS — Capture A, AAAA, MX, NS, TXT and CNAME records live, then compare against passive DNS history to separate current hosting from prior hosting.
Harvest certificates — Query Certificate Transparency for all issued certificates, extract subject alternative names to enumerate subdomains and identify sibling domains sharing a certificate.
Assess content and behaviour — Submit to urlscan.io or a sandboxed browser to capture redirect chains, hosted content, embedded scripts and any credential-harvesting form targets.
Pivot outward — Move to the hosting IP, the ASN, the nameserver operator and the registrant email, then re-query each for other domains sharing those attributes.
Score and record — Assign confidence based on registration age, infrastructure overlap and third-party verdicts, then preserve raw responses with timestamps for the case record.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Cyber Intelligence — Adversary Activity in Networks and Systems
Threat Actor Intelligence — Tracking Adversary Groups Over Time
Vulnerability Intelligence — Weaknesses, Exploitation, and Prioritization
Criminal Intelligence — Intelligence Supporting Criminal Investigation
Disinformation Intelligence — Detecting and Analyzing Information Manipulation
Technical Intelligence — Technology Capability, Design, and Exploitation
Open Source Intelligence — Publicly Available Information, Systematically Collected
Malware Intelligence — Understanding Malicious Code
News Intelligence — Media Reporting as an Intelligence Source
Government Intelligence — Government Structures, Policy, and Officials

Investigated in these domains

Pivots to these data points

IP Address — Internet Protocol address identifying a device or server on a network.
URL — Uniform Resource Locator pointing to a web resource.
ASN — Autonomous System Number identifying a network operator on the internet.
Subdomain — A host under a parent domain — often reveals staging, admin, and forgotten infrastructure.
IP Range / CIDR — A block of IP addresses expressed in CIDR notation — the unit of network ownership and allocation.
MAC Address — Hardware address of a network interface; the OUI prefix identifies the manufacturer.

Inside the platform: where Domain Name lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

url-profile.php — Domain Name profile
datapoint.php?dp=dp_domain — Data point hub
threat-dashboard.php?theme=nation_state — Nation State dashboard
actor-profile.php — APT / Espionage dashboard
ioc.php — Cyber Crime dashboard
ransomware.php — Ransomware dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
DNS Audit
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Normalise the input is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Resolve and record DNS turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Score and record feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Domain Name

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

A defence analyst treats a domain as an indicator feeding force protection and cyber situational awareness rather than as a target in itself. Registration timing, registrar choice and nameserver reuse support pattern-of-life work on an adversary's infrastructure cycle, informing J2 reporting and network defence tasking for deployed systems. Where a domain impersonates a coalition or contractor brand it becomes an information operations indicator and feeds deception awareness briefings. Constraints are significant: domain data alone rarely meets the standard for any offensive recommendation, foreign registrant personal data attracts handling rules, and any activity beyond passive collection normally requires separate authority under national cyber operations policy and rules of engagement.

🕵 National intelligence

National intelligence use is requirements driven: a domain enters collection because it answers a standing question about an actor, a campaign or a procurement network, not because it looks suspicious. RDAP, passive DNS and certificate transparency are unclassified sources that can be fused with classified reporting to produce infrastructure graphs at a releasable classification, which is analytically valuable because it can be shared with partners and industry. Handling rules matter: registrant personal data belonging to protected persons triggers minimisation, and provenance must be recorded so a downstream customer can see the observation was open source. Dissemination normally rides in infrastructure annexes to all source assessments rather than standalone reporting.

👮 Law enforcement

For law enforcement the domain is often the first exhibit and the first legal process target. RDAP and passive DNS are obtainable without process and should be captured with a timestamped, hashed preservation copy. Registrant identity behind privacy redaction requires a production order or subpoena and, across borders, an MLAT or a direct request under the relevant cooperation instrument. Payment records held by the registrar are the real identity link. Registrar abuse contacts support suspension, but suspension can destroy evidence, so preservation requests should precede takedown. For charging, the domain supports counts of fraud, unauthorised access or trademark offences once tied by server logs and payment data to a defendant.

🔍 Private investigation and corporate security

Corporate security and private investigators use domains for brand abuse monitoring, supply chain due diligence and pre litigation evidence. Newly registered lookalike domains are the earliest reliable warning of a business email compromise or credential phishing attempt against the client, and certificate transparency monitoring gives days of lead time. A private actor may lawfully collect published registration and DNS data and may commission a UDRP filing or court action, but may not compel disclosure of redacted registrant data, may not pretext a registrar or hosting provider, and may not access the target's systems. Findings should be packaged so counsel can convert them into a subpoena or a domain dispute filing.

📰 Journalism and OSINT media

For journalists a domain is a verifiable, citable artifact and one of the few OSINT pivots that produces documentary evidence rather than inference. Standard practice is to capture RDAP output, certificate transparency entries and archived page snapshots, then corroborate with at least one independent line such as payment infrastructure, staff social accounts or corporate filings. Historic WHOIS is powerful but must be dated and attributed, because pre redaction records can be years old. Do not publish a registrant's home address or personal email even when technically public. Right of reply belongs to the named registrant, and source protection means querying from infrastructure not attributable to the newsroom or the source.

🌍 NGO, humanitarian and human rights

Human rights and humanitarian organisations use domain analysis to document disinformation networks, phishing against activists, and infrastructure behind unlawful surveillance vendors. Do no harm applies directly: exposing a domain can alert an operator who then retaliates against local partners, so publication timing is a protection decision rather than an editorial one. Documentation for accountability mechanisms should follow the Berkeley Protocol, with hashes, capture times and tool versions recorded so material survives later scrutiny. Duty of care extends to staff conducting the collection, who should use organisational, non attributable infrastructure. Registrant personal data on individuals in repressive contexts is retained only where necessary and stored under access control.

🎓 University and research

Researchers use domain data for measurement studies of abuse ecosystems, registrar policy effects and takedown efficacy. Methodological rigour means sampling from a documented population, stating the resolver and vantage point, and recording collection windows, because passive DNS coverage and certificate log completeness both vary. Reproducibility is served by publishing query code and derived indicators rather than raw registrant records. Ethics review is usually required when registration data can identify individuals, even though the data is public, and institutional policy commonly treats collection under terms of service as a review question. Cite datasets by version and DOI where available, and share aggregates instead of personally identifying rows.

Playbook: working Domain Name end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Scope and authority

Establish why the domain is in scope, which case or requirement it answers, and what authority covers the work. Record whether the investigation is passive collection only or includes authorised interaction. Decide in advance what you will not do, such as fetching content from attributable infrastructure or contacting the registrant. A good output is a short scoping note with case reference, lawful basis for processing registrant personal data, and a retention date. Stop when the note is agreed and logged; if you cannot state an authority, do not proceed.

Phase 2 — Normalise and derive the registrable domain

Lowercase the string, strip trailing dots, decode Punycode to Unicode and record both forms, then apply the Public Suffix List to derive the registrable domain and the effective TLD. This prevents grouping errors on suffixes like co.uk and on dynamic DNS parents where the registrant controls only a label. A good output is a canonical record holding the raw input, the normalised form, the Punycode and Unicode variants, and the eTLD plus one. Stop when the derivation is deterministic and repeatable.

Phase 3 — Registration baseline

Query RDAP at both registry and registrar level, capturing creation, updated and expiry dates, status codes, nameservers and abuse contacts, and preserve the raw JSON with a query timestamp. Follow with historic WHOIS where licensed, noting that pre redaction records are point in time assertions. A good output distinguishes what is authoritative now from what was asserted historically, with dates attached to each. Stop when you can state the domain age, the registrar, the current status codes and whether registrant data is redacted by policy.

Phase 4 — Live DNS capture

Resolve A, AAAA, MX, NS, TXT, SOA, CAA and CNAME directly against the authoritative nameservers as well as through a neutral public resolver, and record both answers with TTLs. Divergence between the two indicates caching, filtering or split horizon configuration and is itself a finding. A good output is a full record set with per record TTL, resolver identity and query time. Stop when every record type has been queried and the answers are preserved verbatim rather than summarised.

Phase 5 — Certificate transparency sweep

Search certificate transparency logs for every certificate ever issued for the domain and its wildcards, extracting subject alternative names, issuers, issuance dates and serials. Sibling names on a shared certificate are frequently the strongest link to related infrastructure, and issuance cadence shows when the operator built out. A good output is a deduplicated hostname list with first seen dates and the certificates that revealed each. Stop when you have covered all logged issuers rather than only the current live certificate.

Phase 6 — Historic resolution reconstruction

Pull passive DNS to build a timeline of every address the domain resolved to, with first and last seen dates, and do the same for MX and NS values. This separates current hosting from the hosting in use at the time of the incident, which is the version that matters evidentially. A good output is a dated resolution table that can be aligned against victim telemetry. Stop when the timeline covers the incident window with acknowledged gaps rather than assumed continuity.

Phase 7 — Content and behaviour assessment

Submit the domain to a sandboxed rendering service or fetch through non attributable infrastructure, capturing screenshots, redirect chains, loaded resources, form targets and asset hashes. Never fetch from case or corporate ranges. Where cloaking is suspected, compare results across user agents and vantage points. A good output is a preserved capture bundle with hashes and capture time, plus an explicit statement of whether content was live at that moment. Stop before any interaction that submits data or attempts authentication.

Phase 8 — Infrastructure pivot

Move outward from the domain to hosting address, covering prefix, origin ASN, nameserver operator, mail provider, certificate serial and any registrant selector still visible, then query each for other domains sharing that attribute. Rank pivots by discriminating power: a shared nameserver at a boutique provider is strong, a shared CDN address is worthless. A good output is a candidate cluster with the pivot that produced each member recorded. Stop when new pivots stop yielding non trivial members.

Phase 9 — Cluster validation

Test each candidate cluster member against independent evidence: does it share a kit, a certificate, a registration burst, a naming convention or an operator error such as a reused analytics identifier. Discard members supported only by shared commodity hosting. A good output is a scored cluster with confidence per member and the specific evidence for each. Stop when every retained member has at least two independent supporting observations, or is explicitly marked as low confidence.

Phase 10 — Action and notification

Decide the disposition: monitor, report to registrar and host, refer to law enforcement, block internally, or file a domain dispute. Package precise evidence, the exact hostnames, timestamps and preserved captures, into the format each recipient accepts. Where evidence may be needed later, send a preservation request before requesting suspension. A good output is a dated notification record with reference numbers. Stop when the disposition is recorded and any takedown request has an acknowledgement or an escalation deadline.

Phase 11 — Monitoring and closure

Place standing monitors on certificate transparency for the registrable domain and its lookalikes, on nameserver and registrar changes, and on re registration after expiry. Set the review date from the scoping note and record what would reopen the case. A good output is an active monitor with defined alert conditions plus a closure note listing retained artifacts, their hashes and their deletion date. Stop when monitoring is live, retention is scheduled and the case record is complete.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
RDAP protocol and bootstrap registry	Open	Structured successor to WHOIS returning registration dates, status codes, nameservers and abuse contacts as JSON with defined object types.	Primary authoritative baseline for domain age, registrar identity, status codes and the abuse address used for takedown.
ICANN Lookup and registry policy documentation	Open	Registration lookup service plus the contractual policy framework governing gTLD registrars, redaction and abuse handling obligations.	Confirms which registrar and registry are contractually accountable and what abuse response obligations they carry.
Public Suffix List	Open	Community maintained list of effective top level domains under which members of the public can register names.	Derives the correct registrable domain so grouping, deduplication and takedown scope are not miscounted on multi label suffixes.
crt.sh	Open	Searchable index of certificate transparency logs exposing every publicly logged certificate, its subject alternative names, issuer and validity dates.	Enumerates subdomains and sibling domains sharing a certificate, and dates the operator build out and relaunch cycles.
Certificate Transparency programme documentation	Open	Specification and log ecosystem describing append only logs, signed certificate timestamps and the monitor and auditor roles.	Explains completeness limits of certificate evidence and supports precise statements about what a log record proves.
SecurityTrails	Registration	Commercial passive DNS and historic WHOIS aggregation with subdomain listings, record change history and reverse lookups.	Reconstructs the resolution timeline for the domain and pivots on historic nameservers and registrant selectors.
DNSDumpster	Open	Free consolidated DNS reconnaissance view showing common record types, discovered hosts and hosting relationships for a domain.	Fast first pass map of hosting and mail infrastructure before committing to licensed passive DNS queries.
urlscan.io	Registration	Sandboxed browser captures with screenshots, redirect chains, DOM, loaded resources, hashes and a searchable corpus of prior scans.	Safely captures hosted content and finds other domains serving the same kit, favicon hash or page structure.
VirusTotal	Registration	Aggregated vendor verdicts plus relations data covering resolutions, communicating files, referring files and subdomains for a domain.	Corroborates malicious classification and surfaces malware samples that contacted the domain, linking infrastructure to tooling.
abuse.ch URLhaus and ThreatFox	Open	Community reported malicious URLs, payload delivery hosts and command and control indicators with malware family attribution and dates.	Confirms known bad status with a citable observation date and links the domain to a named malware family.
Shodan	Registration	Internet wide scan repository holding service banners, certificates, product and version fingerprints with historic snapshots per address.	Characterises the hosting behind the domain and finds other hosts presenting the same certificate or banner.
Censys	Registration	Full internet scan dataset with structured certificate, service and host records supporting complex queries and historic views.	Certificate centric pivoting from the domain to every other host presenting the same or a related certificate.
Internet Archive Wayback Machine (archived)	Open	Historic page captures of websites over time, including content removed or replaced after enforcement or rebranding.	Evidences what the domain hosted at a past date when the live site is down, cloaked or altered.
IANA root zone database	Open	Authoritative record of top level domains, their sponsoring organisations, registry operators and delegation details.	Identifies the registry operator and jurisdiction for the TLD, which governs both takedown route and legal process.
Spamhaus domain blocklists and reputation data	Registration	Reputation assessments of domains and the networks hosting them, with categorisation of abuse type and listing history.	External corroboration of abusive use and an indication of how registrar and host reputation cluster.
MITRE ATT&CK Resource Development techniques	Open	Structured knowledge base of adversary behaviour including acquisition and staging of domain infrastructure prior to operations.	Provides shared technique identifiers so domain findings map into a common reporting vocabulary across teams.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Domain Name. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

dig and drill — Command line resolvers giving exact, scriptable control over record type, resolver and flags. Limitation: they show current state only, with no history.
whois and RDAP clients — Retrieve registration records from registry and registrar endpoints. Limitation: output format varies widely by registry and most registrant fields are redacted.
Amass — Open source attack surface mapper combining passive sources with optional active enumeration for a domain. Limitation: active modes generate traffic that may exceed authorised scope.
urlscan.io CLI and API — Automates sandboxed capture and searches the historic corpus by domain, hash or page structure. Limitation: public scans are visible to the operator being investigated.
dnstwist — Generates and resolves typosquat, homoglyph and bitsquat permutations of a domain. Limitation: high false positive volume and it misses creative non permutation lookalikes.
certstream and certificate transparency monitors — Streams newly logged certificates in near real time for keyword and brand matching. Limitation: only catches names that receive a publicly logged certificate.
MISP — Threat intelligence platform for storing, correlating and sharing domain indicators with attributes and taxonomies. Limitation: correlation quality depends entirely on disciplined attribute typing.
Maltego — Graph tool with transforms that automate pivots from domain to certificates, addresses, ASNs and registrant selectors. Limitation: the most useful transforms need paid data subscriptions.
Passive DNS client tooling — Queries historic resolution data across multiple providers with consistent output. Limitation: coverage differs by provider, so absence never proves a record did not exist.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
DNS Audit — Bulk-resolves A/AAAA/MX/NS/TXT/CNAME/SOA records and stores them as observations, building passive DNS from your own collection.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Rank pivots by how many domains they would return across the whole internet before you use them. A shared nameserver at a boutique provider narrows to dozens; a shared hyperscaler address narrows to millions and is not evidence of anything.
Registration date is a claim about the current registration period, not about the name. A domain that lapsed and was re registered shows a recent creation date while carrying years of unrelated history in passive DNS and archives.
Certificate issuance cadence often reveals operational tempo better than registration data. A burst of certificates issued minutes apart across many names indicates automated provisioning from a single toolchain rather than organic growth.
Treat redaction as a policy fact and record the registrar redaction behaviour instead of the missing name. Some registrars redact only for European registrants, so the presence of a visible address is itself a jurisdictional hint.
Do not conflate the hosting operator with the operator of the domain. The takedown route follows registrar and registry for the name and follows host and ASN for the content, and choosing the wrong one loses days.
When an operator rotates infrastructure after a takedown, the surviving constant is usually a habit rather than an asset: the same registrar, the same TLD, the same naming grammar, the same certificate authority. Hunt the habit.
Capture before you report. A suspension request often precedes content deletion and log rotation, and evidence that existed at the moment you first looked will not exist when a court later asks for it.
A domain that resolves nowhere is not dormant. Check MX and TXT records, since an actor may operate the name purely for mail or for a verification token that ties it to a cloud tenant they control.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Domain Name is producing anything, and they are worth baselining before you change process or tooling.

Median time from certificate transparency issuance of a lookalike domain to detection and internal blocking, measured in hours rather than days.
Proportion of confirmed phishing domains against the organisation that were identified before the first user click rather than after an incident report.
Registrar and registry takedown acknowledgement and suspension times, tracked per provider so escalation routes can be chosen on evidence.
Share of investigated domains where a cluster of two or more related names was established, indicating pivot discipline rather than single artifact reporting.
False positive rate of automated lookalike detection after analyst review, tracked to keep alerting credible with the response team.
Percentage of domain findings that carry preserved raw RDAP, DNS and certificate responses with timestamps, measured by sampling closed cases.
Recurrence rate: how often a taken down actor reappears on new domains within thirty days, which measures whether disruption changed anything.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

GDPR and registry redaction have removed registrant detail from most RDAP output, so absence of a name is a policy artifact, not evasion.
Shared hosting and CDN front-ends mean a resolved IP is often occupied by thousands of unrelated domains and proves nothing about ownership.
Compromised legitimate domains look established and well-aged, so registration age alone will misclassify hijacked infrastructure as benign.
Passive DNS is sampled, not complete, and absence of a record reflects sensor coverage rather than absence of the resolution.
Expired domains change hands silently, so historic malicious activity may belong to a completely different party than the current registrant.
Privacy and proxy registration services legitimately mask millions of benign registrants and are not by themselves an indicator of malice.

Legal and ethical considerations

Registration and DNS data are public records and generally lawful to collect, but registrant names, postal addresses and contact emails are personal data under GDPR and comparable regimes. Process them on a documented lawful basis, usually legitimate interest for network security, and minimise what you retain. Interacting with hosted content can constitute access to a computer system, so use sandboxed infrastructure and stay within passive observation unless you hold authorisation. Preserve raw RDAP, DNS and certificate responses with timestamps and source attribution so findings remain defensible.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Domain Name, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 10 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Registrant data is redacted. Is the investigation dead?

No. Redaction removes one field and leaves the whole infrastructure surface intact. Certificate transparency, passive DNS, nameserver reuse, hosting choice, mail configuration, page assets and payment endpoints all support clustering without any registrant name. Historic WHOIS from before redaction is frequently still available under licence and may name an earlier holder. If identity is genuinely required, the route is legal process to the registrar for account and payment records rather than open source inference, and those records are far stronger evidentially than a WHOIS field ever was.

How do I tell a purpose built malicious domain from a compromised legitimate one?

Look at age, history and content coherence together. A purpose built domain typically registers days before use, has no archived history, holds a single certificate, and serves content unrelated to its name. A compromised domain has years of archived legitimate content, a stable nameserver and mail configuration, and the malicious content sits at an odd path under an otherwise normal site. Compromise also usually leaves the original site functional. Getting this wrong matters because the response differs entirely: notify and assist the owner rather than seeking suspension of their name.

Is it safe to visit the site to see what it does?

Not from anything attributable to you or your organisation. Fetching content is an interaction that logs your address, reveals your interest and may trigger campaign rotation or cloaking. Use a sandboxed rendering service, a purpose built analysis environment on unattributable infrastructure, or an existing capture. Be aware that public scan submissions are themselves visible, so a submission can alert the operator. Where the content may be illegal material, do not retrieve it at all and follow your jurisdiction's mandatory reporting route immediately.

How much does a shared address prove?

Very little on its own. Shared hosting, content delivery networks and reverse proxies routinely place thousands of unrelated domains behind one address, so co location is only meaningful when the address is dedicated and the tenancy is narrow. Establish the population first: check how many domains resolve to that address in passive DNS, and check whether the range is a hyperscaler or a small dedicated block. A shared certificate, a shared unusual banner or a shared self signed key is far better evidence of common control than a shared address.

What is the fastest reliable early warning for brand impersonation?

Certificate transparency monitoring, because almost every phishing site now obtains a publicly logged certificate before it goes live. Stream new certificate entries, match against your brand tokens, common misspellings, homoglyph variants and keyword combinations, and route hits to review. This typically gives hours to days of warning before the first email lands. Supplement with newly registered domain feeds and passive DNS, since some operators reuse an existing wildcard certificate and never trigger a new log entry.

Should I request takedown immediately?

Only after preservation. Suspension frequently removes the content, the logs and the DNS records you will later need, and it tells the operator they have been detected. Sequence it: capture and hash the evidence, send a preservation request to the registrar and host where the case may become criminal, complete your infrastructure pivots while the estate is still connected, then request suspension. Where active victim harm is ongoing that calculus flips and speed wins, but make it a recorded decision rather than a reflex.

Can I rely on domain age as a risk score?

As one input only, and with a defined window. Registration within the last thirty days genuinely correlates with abuse, but it also captures every legitimate new business, campaign microsite and product launch, so age used alone produces unacceptable false positives. Combine it with registrar reputation, TLD, lexical similarity to protected brands, mail posture and hosting classification. Remember that compromised domains invert the signal entirely: the most damaging phishing often runs on well aged, high reputation names.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ICANN Registrar Accreditation Agreement and Registry Agreements, which set abuse contact obligations, data escrow requirements and the framework for registrar accountability.
ICANN gTLD Registration Data Policy and the Registration Data Request Service, governing what registration data is published and how a requester seeks non public elements.
RFC 7480 to 7484 and RFC 9082 and 9083, defining the RDAP protocol, bootstrapping, query format and JSON response structure that replaced WHOIS.
RFC 6962 and RFC 9162, defining certificate transparency logs, signed certificate timestamps and the monitor and auditor roles that make log evidence auditable.
UDRP and the Uniform Rapid Suspension system, the ICANN dispute mechanisms used by rights holders to obtain transfer or suspension of infringing registrations.
GDPR Articles 5 and 6 and equivalent national law, governing lawful basis, minimisation and retention when registrant personal data is processed for security purposes.
Berkeley Protocol on Digital Open Source Investigations, setting capture, preservation and analysis standards for open source material intended for accountability proceedings.
Budapest Convention on Cybercrime, providing the expedited preservation and mutual assistance mechanisms used to obtain registrar and hosting records across borders.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Registration Data Access Protocol specifications — IETF. The RFC series defining RDAP queries, bootstrapping and JSON responses for domain registration data.
IANA Root Zone Database — IANA. Authoritative listing of top level domains with sponsoring organisations and registry operators.
ICANN policy and contractual compliance resources — ICANN. Registrar and registry obligations, registration data policy and the abuse complaint framework.
Public Suffix List — Mozilla Foundation. The maintained list of effective top level domains used to derive registrable domain boundaries.
Certificate Transparency — Certificate Transparency community. Specification, log ecosystem and tooling documentation for publicly auditable certificate issuance.
crt.sh certificate search — Sectigo. Public search interface across certificate transparency logs used for subdomain and sibling name discovery.
URLhaus and ThreatFox — abuse.ch. Open community datasets of malicious URLs, delivery hosts and command and control indicators.
MITRE ATT&CK Enterprise matrix — MITRE. Adversary technique taxonomy including domain acquisition and infrastructure staging behaviours.
Berkeley Protocol on Digital Open Source Investigations — UN OHCHR. Methodological standard for collecting and preserving open source digital evidence for legal accountability.
Convention on Cybercrime — Council of Europe. Treaty framework for expedited preservation, production orders and mutual legal assistance for internet hosted evidence.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: continuous domain monitoring, registration and certificate enrichment, and one-click pivots to hosting, ASN and sibling infrastructure. Explore the platform, or browse the rest of the library by following any tag above.