Lion Cipher Lab
Pivot on nameservers and SOA records -- and measure which pivots are noise
- Threat Intel Analyst
- Intermediate
- ~70 min
- Free · no account required
Why it matters
When you find one malicious domain, the next question is always: what else does this operator own? Resolution data (which IP a domain points at) is the usual pivot, but operators move IPs constantly. The DNS zone itself carries quieter fingerprints: which nameservers serve it, and the SOA record's contact address and serial number, which many operators copy from one zone file to the next without thinking. A cheap actor who runs their own nameserver, or reuses one contact address, can be mapped from a single seed in seconds. But the same fields are some of the noisiest in all of threat…
What you'll learn
- Reading a domain's SOA and NS records with nslookup (or dig) and naming every SOA field
- Decoding an SOA RNAME into the email address it encodes, including the backslash-dot rule from RFC 1035
- Telling a date-format SOA serial (YYYYMMDDnn) from an opaque counter, and knowing why neither is an identity
- Measuring the precision and recall of each zone-metadata pivot (NS host, NS set, MNAME, RNAME, serial, registrar) from one seed
- Using key rarity to stop a pivot from exploding through shared providers, and multi-hop expansion to reach a second vanity nameserver
- Turning weak keys (registrar + creation date) into a ranked lead list for a human instead of an automatic verdict
Steps in this lab
- The fields you will pivot on -- every term, defined once
- When you would reach for this -- and when not
- Part 1 (real): read the SOA and NS of two real domains
- Decode the RNAME and classify the serial
- Part 2 (measured): build a labelled zone dataset with an operator hiding in it
- Pivot once on each field and score it
- Expand in hops -- and watch rarity decide whether you find an operator or a provider
- Weak keys belong in a lead list, not in the verdict
- Honest limits -- where these pivots lie
- Where this goes next