DNS 历史记录解决方案可提升互联网透明度和网络安全性

实际应用

• DNS 资产揭露

  通过发现用于特定 Web 应用程序和服务的关联或隐藏域名和子域名，从而保持资产清单的最新状态。

• 威胁监测

  识别不寻常的 DNS 解析模式，这些模式可能表明存在僵尸网络活动或用于托管或传播恶意软件的被攻陷的基础设施。

• 威胁行为者监测

  对已知威胁行为者相关的 DNS 解析、可能为恶意活动的模式或异常保持警惕。

• 品牌保护

  监测DNS记录变化，以检测域名劫持尝试，并评估相关域名如何影响品牌声誉。

• 第三方风险评分

  使用 DNS 数据来跟踪域名配置变化，识别相关联的基础设施，监测与供应商和其他第三方相关的可疑活动。

• 欺诈监测

  通过分析 DNS 模式、域名所有权变更以及与恶意服务器的先前关联来揭露欺诈行为。

常见问题

DNS 记录是什么？

DNS 记录是存储在域名系统 (DNS) 中的数据记录，可将域名映射到特定资源，例如 IP 地址、邮件服务器或其他服务。DNS 服务器解析这些记录可引导互联网流量并管理与域名相关的服务。常见的 DNS 记录类型包括：

• A 记录：将域映名射到 IPv4 地址。
• AAAA 记录：将域名映射到 IPv6 地址。
• MX 记录：指定用于电子邮件传递的邮件服务器。
• NS 记录：列出域名的权威名称服务器。
• TXT 记录：存储基于文本的信息，通常用于域名所有权验证（例如 SPF、DKIM 或 DMARC 设置）或其他元数据。例如，验证网站所有权使用谷歌搜索Console 需要将某个 TXT 记录添加到域名的主机记录列表中。
• CNAME 记录：将别名或子域名映射到另一个域名。例如，它可以将 blog.example.com 重新定向到 www.example.com。
• SOA 记录（开始授权机构）：包含有关域名的管理信息，例如主名称服务器、域名管理员的联系电子邮件以及 DNS 区域的版本号。
• PTR 记录（指针）：将 IP 地址解析为域名，常用于反向 DNS 查找。

如需获取有关域名的当前 DNS 记录的信息，可使用我们的DNS 查询工具或DNS 查询 API 。

域名的 DNS 历史是什么？

域名的 DNS 历史记录是过去的DNS配置列表，包括 IP 地址、域名服务器、邮件服务器和其他 DNS 记录随时间的变化。它能够洞悉域名基础设施的演变历程，并揭示所有权变更、迁移或潜在的滥用情况。

与大量 WHOIS 数据不同，DNS 数据不会因隐私而被编辑，因此历史 DNS 记录对于网络安全来讲是非常有用的。

域名系统并非为追踪历史记录而设计的，由于它们拥有巨大的价值，独立供应商自然而然就开始创建和维护 DNS 历史记录数据。

用户可从 DNS 历史记录中获取哪些数据？

域名的 DNS 历史记录通常包括以下详细信息：

• 历史 A 记录： IPv4 地址映射的变更。
• 历史 AAAA 记录： IPv6 地址映射的变更。
• 历史 MX 记录：邮件服务器配置的变更。
• 历史 NS 记录：权威名称服务器的更新。
• 历史 TXT 记录：过去基于文本的信息，通常与验证或安全有关。
• 历史 CNAME 记录：对子域名的别名或重新定向的更改。
• 历史 SOA 记录：管理详细信息的更新，例如主要名称服务器或区域版本。
• 历史 PTR 记录： IP 地址到域名的历史映射，用于反向 DNS 查询。
• 带时间戳的更改和更新：显示每条记录新增、删除或更新的时间线。

此信息提供了域名的 DNS 活跃的详细时间线，有助于发现模式、基础设施变化、与恶意行为者的潜在联系等。

以下是使用我们的历史 DNS 查询工具查找到的 example.com 的示例，该工具可提取历史 IP 到域名或域名到 IP 的信息：

历史 DNS 数据有哪些用途？

历史 DNS 数据在网络安全、威胁情报和资产管理领域有着广泛的实际应用，可用作：

• 将 DNS背景信息添加到 SIEM、SOAR 和 TIP 平台：使用 DNS 情报丰富安全系统，以便更好地做出决策。
• 加速威胁监测和响应：识别与恶意活动相关的异常 DNS 变化或模式。
• 扩大资产发现和漏洞管理：通过 DNS 记录定位未管理或被遗忘的域名、子域名和相关资产。
• 识别悬空的 DNS 记录和不安全的子域名：监测可能导致数据泄露或被利用的错误配置。
• 扩大威胁情报收集：分析历史 DNS 记录，发现域名与已知威胁行为者基础设施之间的关联性。
• 监测可疑或恶意域名的 DNS 基础设施的变化：随时了解可能预示新威胁的变化更新。
• Run SaaS service discovery analyses: Identify services and platforms linked to a domain using clues from DNS records and subdomains.

These capabilities make historical DNS data a very useful resource for improving security posture and gaining deeper insights into domain activity and associated risks.

How to check DNS history?

To check DNS history:

• Use a historical DNS lookup tool like our DNS Chronicle Lookup.
• Enter the domain name you want to investigate.
• Review the historical data on DNS records, including changes and updates over time.

Alternatively, you can refer to the WhoisXMLAPI's DNS Database Download service or use the DNS Chronicle API. These data delivery models provide detailed, time-stamped DNS records and could come in handy when you need to automate requests for historical DNS records.

How to use DNS history for security threat detection?

DNS history can help identify suspicious activity or patterns, such as:

• Sudden changes in name servers or IP addresses that could indicate repurposing a domain for a phishing or malware campaign.
• Rapid changes in A or AAAA DNS records – a technique called fast-flux that helps evade traditional detection methods, which is often an indicator of malicious activity.
• Domains with records pointing to known malicious infrastructure (based on IoCs provided by threat intelligence).

By analyzing DNS history, security teams can detect and respond to potential threats proactively.

How to use DNS history for threat actor monitoring?

DNS history can reveal connections between domains and threat actors by:

• Tracking repeated use of specific IP addresses or name servers and other patterns in DNS record changes linked to known attackers.
• Revealing additional threat actor infrastructure through DNS patterns, as well learning new details about their methods and activities.
• Monitoring threat actor infrastructure migration and proactively identifying yet-to-be-used infrastructure.

This helps cybersecurity providers keep tabs on threat actors' evolving tactics and infrastructure.

How to use DNS history for fraud detection?

DNS history aids fraud detection by uncovering:

• Record changes that align with phishing or scam activities such as rapid switching of IP addresses (A and AAAA records) or name servers.
• Use of disposable or suspicious DNS records with low TTL values or lack of legitimate MX records that normally should be present.
• Historical data linking fraudulent domains to known malicious networks such as common name servers, IP addresses, and registrars.

These insights help investigators trace and mitigate fraudulent schemes.

How to use DNS history for asset discovery?

DNS history provides a comprehensive view of domain activity, which can:

• Identify domains or subdomains tied to your organization that could pose risks if left unmonitored or used maliciously by others after expiration or transfer.
• Highlight forgotten or unmonitored digital assets such as old subdomains or backup domains that might still be publicly accessible and can serve as entry points for attackers if not secured properly.
• Uncover DNS issues like misconfigured DNS records that could expose sensitive data such as internal services, sensitive IP addresses, or cloud resources.

By leveraging DNS history, organizations can improve visibility and security of their digital assets.

How to use DNS history for brand protection?

DNS history supports brand protection by allowing you to detect:

• Cybersquatting domains impersonating your brand that have suspicious IP changes or repeated use of nameservers linked to phishing campaigns. Such changes may indicate malicious intent of the domain owners.
• Potentially malicious traffic that could signal website defacement attempts. Website application firewalls (WAFs) can block such traffic from known malicious IP addresses that are requesting access to your website.
• Suspicious subdomains linked to your own infrastructure that may signal subdomain takeover.

We recommend using DNS history together with predictive threat intelligence feeds for better results and correlation when it comes to brand protection efforts. Read our blog post to learn more about using DNS history for brand attack prevention.