PADNS Density Lookup returns the number of unique domains associated with a nameserver, mail server, hash, IP address, ASN, or content hash value (CHV). Use it to measure how densely an infrastructure element is shared across domains in Silent Push passive DNS data.
High density can indicate shared hosting, CDNs, or concentrated malicious infrastructure. Low density can indicate dedicated or newly stood-up assets.
PADNS Density Lookup
From the left navigation menu, select Advanced Query Builder > PADNS Queries > Density Lookup (Get density/number of domains for qtype).
On the Simple Query tab, select a qtype:
NSSRV — nameserver hostname
MXSRV — mail exchange hostname
NSHASH — nameserver set hash
MXHASH — MX set hash
IPV4 — IPv4 address
IPV6 — IPv6 address
ASN — Autonomous System Number
CHV — content hash value
Enter the value to look up in the query field (for example, a nameserver, IP, ASN, or hash).
Select a scope to control how density is counted:
ip
subnet
subnet_ips
asn
asn_subnets
host
domain
subdomain
chv
chv_analysis
Click Search.
Review the results panel. Use Copy Raw Data to copy the response or Copy API URL to reuse the request outside the UI.
Click Reset Form at any time to clear the current query parameters. Use the Advanced Query tab when you need additional filters.
How to interpret density
Density is the count of unique domains observed against the selected qtype and scope.
High nameserver or MX density can mean a shared provider — or a cluster of attacker-controlled domains on the same NS/MX set.
High IPv4/IPv6 or subnet density can mean many domains hosted on the same address or range.
High ASN density can indicate a hosting network that hosts many domains.
CHV / chv_analysis density groups domains that share the same web content fingerprint.
Save Query
Specify query parameters.
Click Save Query.
Provide a Name and Description for context.
Click Save. The query appears in Private Queries.