Early Protection from Unknown Domains
New domains are created and published every day as part of the Domain Name System (DNS) – but not all of them are created for legitimate purposes. Bad actors use new domains for criminal activities such as spam, malware distribution or botnets in the first minutes of creating them. Farsight NOD provides organizations with real-time actionable insights based on the newness of a domain.
Block outbound connections to newly minted and used domains by leveraging NOD Response Policy Zones on DNS Servers; thus, disrupting techniques commonly used by modern malware.
Take immediate action in case of suspected brand phishing, confusion or dilution when new names are detected. New domains are often used to trick users by creating a lookalike site. These domains are dangerous until they are classified and blocked. They can be blocked for periods of time by leveraging NOD Response Policy Zones on DNS Servers.
Filter email of very young domains (e.g., five minutes old or newer, 30 minutes old or newer, etc.) by adding SpamAssassin rules that readily consume this DNSBL. Most email coming from new, lookalike domains can be malicious. It’s good practice to protect users from these messages.
We observe millions of domains each day and detect that more than 100,000 of those are newly configured from the perspective of the historical DNSDB database. Leveraging more than 2 TB of daily real-time Passive DNS data, NOD discovers newly configured domains when they are first used. This is a great contrast to the typical 17 hours after registration using other discovery methods such as TLD Zone File Access or WHOIS.
NOD is available as a real-time stream as Security Information Exchange (SIE) Channel 212. With NOD, newly observed domains in DNS zone file format can be queried or downloaded.
© 2024 DomainTools
DomainTools® and DomainTools™ are owned by DomainTools, all rights reserved.
