id: soa-detect

info:
  name: SOA Record Service - Detection
  author: rxerium
  severity: info
  description: |
    Detects which domain provider a domain is using, detected through SOA records
  reference:
    - https://www.cloudflare.com/learning/dns/dns-records/dns-soa-record/
  metadata:
    verified: true
    max-request: 1
  tags: dns,soa

dns:
  - name: "{{FQDN}}"

    type: SOA

    matchers-condition: or
    matchers:
      - type: word
        name: "cloudflare"
        words:
          - "dns.cloudflare.com"

      - type: word
        name: "amazon-web-services"
        words:
          - "awsdns"

      - type: word
        name: "akamai"
        words:
          - "hostmaster.akamai.com"

      - type: word
        name: "azure"
        words:
          - "azure-dns.com"

      - type: word
        name: "ns1"
        words:
          - "nsone.net"

      - type: word
        name: "verizon"
        words:
          - "verizon.com"

      - type: word
        name: "google-cloud-platform"
        words:
          - "googledomains.com"
          - "google.com"

      - type: word
        name: "alibaba"
        words:
          - "alibabadns.com"

      - type: word
        name: "safeway"
        words:
          - "safeway.com"

      - type: word
        name: "mark-monitor"
        words:
          - "markmonitor.com"
          - "markmonitor.zone"

      - type: word
        name: "hetznet"
        words:
          - "hetzner.com"

      - type: word
        name: "edge-cast"
        words:
          - "edgecastdns.net"
# digest: 4a0a0047304502207543d23b674d6f6af33197f11d534a088adecaa546feb4f674e59c3e17435c14022100ac553ae6b8aa7adc877bf3324accc71ae8801972775c0ed2961e076777d0b66c:922c64590222798bb761d5b6d8e72950