2024-03-17 12:54:28 +00:00
|
|
|
id: soa-detect
|
|
|
|
|
|
2024-03-23 09:28:19 +00:00
|
|
|
info:
|
|
|
|
|
name: SOA Record Service - Detection
|
|
|
|
|
author: rxerium
|
|
|
|
|
severity: info
|
|
|
|
|
description: |
|
|
|
|
|
Detects which domain provider a domain is using, detected through SOA records
|
|
|
|
|
reference:
|
|
|
|
|
- https://www.cloudflare.com/learning/dns/dns-records/dns-soa-record/
|
|
|
|
|
metadata:
|
|
|
|
|
verified: true
|
|
|
|
|
max-request: 1
|
|
|
|
|
tags: dns,soa
|
|
|
|
|
|
2024-03-17 12:54:28 +00:00
|
|
|
dns:
|
|
|
|
|
- name: "{{FQDN}}"
|
2024-03-19 10:57:34 +00:00
|
|
|
|
2024-03-17 12:54:28 +00:00
|
|
|
type: SOA
|
2024-03-19 10:57:34 +00:00
|
|
|
|
2024-03-17 12:54:28 +00:00
|
|
|
matchers-condition: or
|
|
|
|
|
matchers:
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "cloudflare"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "dns.cloudflare.com"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "amazon-web-services"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "awsdns"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "akamai"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "hostmaster.akamai.com"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "azure"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "azure-dns.com"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "ns1"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "nsone.net"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "verizon"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "verizon.com"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "google-cloud-platform"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "googledomains.com"
|
|
|
|
|
- "google.com"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "alibaba"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "alibabadns.com"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "safeway"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "safeway.com"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "mark-monitor"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "markmonitor.com"
|
|
|
|
|
- "markmonitor.zone"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "hetznet"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
|
|
|
|
- "hetzner.com"
|
|
|
|
|
|
|
|
|
|
- type: word
|
2024-03-19 10:57:34 +00:00
|
|
|
name: "edge-cast"
|
2024-03-17 12:54:28 +00:00
|
|
|
words:
|
2024-03-19 10:57:34 +00:00
|
|
|
- "edgecastdns.net"
|
2024-03-25 11:57:16 +00:00
|
|
|
# digest: 4a0a0047304502207543d23b674d6f6af33197f11d534a088adecaa546feb4f674e59c3e17435c14022100ac553ae6b8aa7adc877bf3324accc71ae8801972775c0ed2961e076777d0b66c:922c64590222798bb761d5b6d8e72950
|
