id: soa-detect

info:
  name: SOA Record Service - Detection
  author: rxerium
  severity: info
  description: |
    Detects which domain provider a domain is using, detected through SOA records
  reference:
    - https://www.cloudflare.com/learning/dns/dns-records/dns-soa-record/
  metadata:
    verified: true
    max-request: 1
  tags: dns,soa,discovery

dns:
  - name: "{{FQDN}}"

    type: SOA

    matchers-condition: or
    matchers:
      - type: word
        name: "cloudflare"
        words:
          - "dns.cloudflare.com"

      - type: word
        name: "amazon-web-services"
        words:
          - "awsdns"

      - type: word
        name: "akamai"
        words:
          - "hostmaster.akamai.com"

      - type: word
        name: "azure"
        words:
          - "azure-dns.com"

      - type: word
        name: "ns1"
        words:
          - "nsone.net"

      - type: word
        name: "verizon"
        words:
          - "verizon.com"

      - type: word
        name: "google-cloud-platform"
        words:
          - "googledomains.com"
          - "google.com"

      - type: word
        name: "alibaba"
        words:
          - "alibabadns.com"

      - type: word
        name: "safeway"
        words:
          - "safeway.com"

      - type: word
        name: "mark-monitor"
        words:
          - "markmonitor.com"
          - "markmonitor.zone"

      - type: word
        name: "hetznet"
        words:
          - "hetzner.com"

      - type: word
        name: "edge-cast"
        words:
          - "edgecastdns.net"

      - type: word
        name: "csc-corporate-domains"
        words:
          - "cscdns.net"

      - type: word
        name: "network-solutions"
        words:
          - "worldnic.com"

      - type: word
        name: "name-services"
        words:
          - "name-services.com"

      - type: word
        name: "ultradns"
        words:
          - "ultradns.com"

      - type: word
        name: "verisign"
        words:
          - "verisign-grs.com"

      - type: word
        name: "ovh"
        words:
          - "ovh.net"

      - type: word
        name: "comlaude"
        words:
          - "comlaude.com"
          - "comlaude-dns.com"

      - type: word
        name: "one-dot-com"
        words:
          - "one.com"

      - type: word
        name: "netnames"
        words:
          - "netnames.net"

      - type: word
        name: "dnsmadeeasy"
        words:
          - "dnsmadeeasy.com"

      - type: word
        name: "bluehost"
        words:
          - "bluehost.com"

      - type: word
        name: "managed-ip"
        words:
          - "managed-ip.com"

      - type: word
        name: "gandi"
        words:
          - "gandi.net"

      - type: word
        name: "brandshelter"
        words:
          - "brandshelter.com"

      - type: word
        name: "hinet"
        words:
          - "hinet.net"

      - type: word
        name: "vultr"
        words:
          - "vultr.com"

      - type: word
        name: "switch-ch"
        words:
          - "switch.ch"
# digest: 4a0a00473045022100b4dad1997875b188a453a6a8b9055c9e1fcf66e49457f37577469ae14628918302207b349f96312120a881fe72369742a9d1b4404e1ae689f07f053ca18ae482eddd:922c64590222798bb761d5b6d8e72950