---
title: "PADNS Queries"
slug: "passive-dns-queries-1"
status: "update"
updated: 2025-12-31T17:11:07Z
published: 2025-12-31T17:11:07Z
canonical: "help.silentpush.com/passive-dns-queries-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PADNS Queries

PADNS query tools empower security teams, threat hunters, and researchers to analyze DNS data for proactive threat intelligence. By leveraging a global store of passive DNS data, Silent Push enables users to map domain-to-IP mappings, track infrastructure changes, and identify malicious patterns such as domain generation algorithms (DGAs), fast-flux techniques, or phishing campaigns. PADNS queries provide granular insights into DNS records, ASNs, IP diversity, Domain Density, self-hosted domains, SOA records, and hash translations, helping organizations stay ahead of cyber threats.

## Key Features

Our PADNS queries support a range of functionalities to uncover attacker infrastructure and assess risks:

### Domain-to-IP and ASN Analysis

- **ASNs for a domain**: Retrieve ASNs associated with a domain’s A records (including subdomains) within the last 30 days to identify hosting networks and detect DGAs or fast-flux techniques.
- **IP diversity**: Measure the number of unique IPs (A/AAAA records) linked to a domain. Low diversity may indicate malicious infrastructure, while high diversity could suggest CDNs or legitimate networks.
- **IP diversity patterns:** Search for patterns in IP diversity with filters for nameservers, domains, ASNs, and timestamps to pinpoint attack vectors.
- **Use case**: Map attacker-controlled networks or identify legitimate infrastructure.

### DNS record and Domain Density Queries

- **Forward Lookup:** Search passive DNS data for record types (A, AAAA, CNAME, MX, NS, PTR4, PTR6, ANY, SOA, TXT) to link domains to IPs or other records. Filters include timestamps, subdomains, and regular expressions.
- **Domain density**: Measure unique domains associated with network elements (e.g., IPs, ASNs, nameservers). High density may indicate malicious activity.
- **Use case**: Uncover relationships between DNS records and detect concentrated malicious activity.

### Self-hosted Domains and SOA Records

- **Self-hosted domains**: Identify domains where nameservers are hosted on the same IP as the domain’s A record, often used for phishing or malware.
- **SOA records**: Monitor DNS zone changes (e.g., serial numbers, refresh values) to detect malicious updates, such as new subdomains or IP changes.
- **Use case**: Detect attacker-controlled infrastructure or track DNS configuration changes.

### Hash Translation

- Translate nshash (nameserver hash) or mxhash (MX server hash) values to server names to track changes in DNS infrastructure, such as domain transfers or new email providers.
- **Use case**: Identify phishing or other malicious activity linked to changes to nameservers or MX servers.

### Save and Collaborate

- Organizational users can save queries in the Private Queries menu for reuse or sharing, streamlining workflows and fostering collaboration.

## Integrate

PADNS queries integrate with platforms like Splunk SOAR and Cortex XSOAR, enabling automated enrichment of DNS data and live URL scans. The API provides programmatic access to query results, returning detailed responses that include ASN details, IP diversity scores, and SOA Record components. For example, querying the domain `example.com` for IP diversity might return:

- **IP Diversity Score**: 10 unique IPs
- **ASNs**: 13335 (CLOUDFLARENET), 15169 (GOOGLE)
- **Timeline**: IPs and timestamps (first_seen, last_seen)

A metric measuring the number of unique domains associated with a network element (e.g., IP, ASN, nameserver, or MX server), used to detect concentrated malicious activity or infrastructure patterns.

A feature leveraging passive DNS data to investigate and correlate related threats, such as associated IPs, domains, or other indicators.

A collection of user-saved DNS queries, stored for repeated use or personalized threat intelligence analysis.

A Start of Authority DNS record containing administrative details about a DNS zone, such as primary nameservers and timing parameters, used to monitor zone changes and detect malicious updates.