Check domains hosted on specific nameservers or mailservers

  • Updated on May 2, 2023
  • Published on Mar 4, 2023
  • 1 minute(s) read

Threat actors often use specific infrastructure or servers to host and distribute malware or engage in other malicious activities.

By scanning for domains hosted on specific nameservers or mailservers, security teams can identify domains that may be associated with the same infrastructure or threat groups.

Nameservers and mailservers are two key components of a public DNS presence that dictate the flow of web and email traffic to and from clients and servers, and are, as such, particularly important in the formation of a robust set of cyber defense mechanisms.

To scan nameservers and mail servers for a list of domains hosted:

  1. Navigate to Explore DNS Data > Domains Hosted on Server

  2. Enter the server's domain name

  3. Select the Server Type (NS or mail server)

  4. (Optional) Specify the time frame when the record was first seen

  5. (Optional) Set the time frame when the record was last seen

  6. (Optional) Tick Last 24 Hours to only show records first observed in the last 24 hours

  7. Specify a Sort Order that applies itself to outputted results

  8. Click Search

Monitoring domain hosting data

You can monitor results populated on the Explore screen for any changes, saving you time and resources by automating key queries across a range of internal workflows.

Monitors run once every 24 hours. You'll be alerted when Silent Push detects new results via email (filtering/sorting options are not applied)

  1. Once you've received a set of results, click the Monitor button on the top right

  2. Specify a Monitor name

  3. Enter a Description

  4. Click Save

  5. Your monitored query is now visible in Monitors > Monitored Queries

  6. Read this article for information on how to share a monitor