---
title: "PADNS Density Lookup"
slug: "padns-density-lookup"
tags: ["Density Lookup", "Infrastructure Analysis", "Passive DNS"]
updated: 2026-09-01T16:40:43Z
published: 2026-09-01T16:40:43Z
canonical: "help.silentpush.com/padns-density-lookup"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PADNS Density Lookup

PADNS Density Lookup returns the number of unique domains associated with a nameserver, mail server, hash, IP address, ASN, or content hash value (CHV). Use it to measure how densely an infrastructure element is shared across domains in Silent Push passive DNS data.

High density can indicate shared hosting, CDNs, or concentrated malicious infrastructure. Low density can indicate dedicated or newly stood-up assets.

## PADNS Density Lookup

1. From the left navigation menu, select **Advanced Query Builder > PADNS Queries > Density Lookup** (Get density/number of domains for qtype).
2. On the **Simple Query** tab, select a **qtype**:
  - **NSSRV** — nameserver hostname
  - **MXSRV** — mail exchange hostname
  - **NSHASH** — nameserver set hash
  - **MXHASH** — MX set hash
  - **IPV4** — IPv4 address
  - **IPV6** — IPv6 address
  - **ASN** — Autonomous System Number
  - **CHV** — content hash value
3. Enter the value to look up in the **query** field (for example, a nameserver, IP, ASN, or hash).
4. Select a **scope** to control how density is counted:
  - **ip**
  - **subnet**
  - **subnet_ips**
  - **asn**
  - **asn_subnets**
  - **host**
  - **domain**
  - **subdomain**
  - **chv**
  - **chv_analysis**
5. Click **Search**.
6. Review the results panel. Use **Copy Raw Data** to copy the response or **Copy API URL** to reuse the request outside the UI.

Click **Reset Form** at any time to clear the current query parameters. Use the **Advanced Query** tab when you need additional filters.

## How to interpret density

- Density is the count of unique domains observed against the selected **qtype** and **scope**.
- High nameserver or MX density can mean a shared provider — or a cluster of attacker-controlled domains on the same NS/MX set.
- High IPv4/IPv6 or subnet density can mean many domains hosted on the same address or range.
- High ASN density can indicate a hosting network that hosts many domains.
- CHV / chv_analysis density groups domains that share the same web content fingerprint.

## Save Query

1. Specify query parameters.
2. Click **Save Query**.
3. Provide a **Name** and **Description** for context.
4. Click **Save**. The query appears in **Private Queries**.