---
title: "Domain Intelligence"
slug: "domain-intelligence"
tags: ["Dynamic DNS", "Domain Analysis", "Domain Intelligence"]
updated: 2026-11-06T18:40:25Z
published: 2026-11-06T18:40:25Z
canonical: "help.silentpush.com/domain-intelligence"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Intelligence

This article documents the Domain Intelligence and Search data sources in SPQL, including domainsearch, domainsearch_api, dynamicdns, stalldomain, and subdomain. These sources provide aggregated infrastructure history, diversity metrics, dynamic DNS records, and domain lifecycle information for advanced threat hunting and domain analysis.

## Domain Intelligence & Search

### domainsearch

Aggregated infrastructure attributes and change history built from repeated observations. Useful for detecting infrastructure shifts, certificate changes, and diversity.

| Field | Type | Description |
| --- | --- | --- |
| asn | number | Current ASN associated with the domain |
| asn_diversity | number | Number of distinct ASNs observed |
| asn_diversity_asn | number | Alternative ASN diversity metric |
| cert_date | datetime | Certificate-related date |
| cert_issuer | string | Certificate issuer |
| first_seen | datetime | First observation date |
| last_seen | datetime | Most recent observation date |
| ns_diversity | number | Number of distinct nameservers |
| domain_age | number | Age of the domain in days |
| timeline_asn | string | Timeline representation of ASN changes |

### dynamicdns

Dynamic DNS records. Key fields include domain, IP, record type, created, and updated timestamps.

### stalldomain & subdomain

Stalled domain observations and subdomain-specific records used for domain lifecycle analysis.