This article documents the Domain Intelligence and Search data sources in SPQL, including domainsearch, domainsearch_api, dynamicdns, stalldomain, and subdomain. These sources provide aggregated infrastructure history, diversity metrics, dynamic DNS records, and domain lifecycle information for advanced threat hunting and domain analysis.
Domain Intelligence & Search
domainsearch
Aggregated infrastructure attributes and change history built from repeated observations. Useful for detecting infrastructure shifts, certificate changes, and diversity.
Field | Type | Description |
|---|---|---|
asn | number | Current ASN associated with the domain |
asn_diversity | number | Number of distinct ASNs observed |
asn_diversity_asn | number | Alternative ASN diversity metric |
cert_date | datetime | Certificate-related date |
cert_issuer | string | Certificate issuer |
first_seen | datetime | First observation date |
last_seen | datetime | Most recent observation date |
ns_diversity | number | Number of distinct nameservers |
domain_age | number | Age of the domain in days |
timeline_asn | string | Timeline representation of ASN changes |
dynamicdns
Dynamic DNS records. Key fields include domain, IP, record type, created, and updated timestamps.
stalldomain & subdomain
Stalled domain observations and subdomain-specific records used for domain lifecycle analysis.