Overview
DNSDB is a Passive DNS (pDNS) historical database that provides a unique, fact-based, multifaceted view of the configuration of the global Internet infrastructure DNSDB leverages the richness of Farsight’s Security Information Exchange (SIE) data-sharing platform and is engineered and operated by leading DNS experts.
Farsight collects Passive DNS data from its global sensor array. It then filters and verifies the DNS transactions before inserting them into the DNSDB, along with ICANN-sponsored zone file access download data. The end result is the highest-quality and most comprehensive Passive DNS data service of its kind - with more than 100 billion DNS records since 2010.
Farsight’s DNSDB Transforms threat feeds into actionable, relevant threat intelligence in real time to increase the value of an organization’s existing threat intelligence. Its high-performance, indexed, time-series DNS intelligence data service can ultimately improve visibility for an organization’s security program and protect its infrastructure from current and future threats.
DNSDB makes it easy to find related domain names and IP addresses, assuming you have an initial domain name or IP address as a starting point. DNSDB can answer questions, such as:
- Where did this domain name point to in the past?
- What domain names are hosted on a given IP address?
- What domain names use a given name server?
- What fully qualified domain names exist below a delegation point?
Farsight Security have created a package of Transforms allowing Maltego to retrieve related information for domains, hostnames, network addresses and ranges, and e-mail addresses. These Transforms use DNSDB to find values that were observed by one of Farsight’s DNS sensors for these Entities, as well as domains resolving to these Entities.
Please take note that the most recent update includes a refresh of all Transform UI names, the functional name for use in Machines stays the same. To line up with Maltego’s naming best practices, the “[DNSDB]” reference has been moved to the end of the Transform name. More information regarding the update, as well as a table with the old and new names can be found here. A flexible search functionality has been provided to enable users to locate Transforms based on both the old and the new Transform names.
The Farsight Security DNSDB Transforms expand the power of Maltego by enabling correlation and contextualization with near real-time and historical DNS intelligence; also known as passive DNS data. Using the DNSDB Transforms users can expose entire networks, gain an outside-in view of their infrastructure and pivot across DNS record types including domains, IPs, NS, MX, AAAA, SOA and many more. Wildcard searches are also available to expose hostnames or Fully Qualified Domain Names (FQDNs) in the left side wildcard, associated domains in the right-side wildcard, and further pivoting across IPs to expose all associated domains, FQDNs, IPs, MX, NS, and other record types.
The DNSDB Transforms for Maltego can be used in any Maltego investigation to:
- Find hostnames related to network addresses.
- Illuminate the DNS (and other service) hosting infrastructure of an interesting domain and finding other domains of interest.
- Finding historical locations of a service identified by a hostname or domain.
Additional Resources
Farsight DNSDB Machines
[DNSDB] Enumerate Domain Machine
Takes a domain Entity, pulls all known hostnames, MX, NS, TXT, grabs IPs for *.domain -> Netblocks -> ASN
[DNSDB] Records with this value
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Records with this value |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrdataDNSName |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To DNSNames with this value
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To DNSNames with this value |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Output Entities | Phrase |
| Short Description | |
Variants
| dnsdbrdataDomain | maltego.Domain |
| dnsdbrdataNetblock | maltego.Netblock |
[DNSDB] To DNSNames with this IP
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To DNSNames with this IP |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrdataIPv4Address |
| Input Entities | maltego.IPv4Address |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To DNSNames from this IPv6 Address
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To DNSNames from this IPv6 Address |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrdataIPv6Address |
| Input Entities | maltego.Phrase |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Domains using this MX
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Domains using this MX |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrdataMXType |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Domains using this NS
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Domains using this NS |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrdataNSType |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To records with this hostname
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To records with this hostname |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Output Entities | Phrase |
| Short Description | |
Variants
| dnsdbrrsetDNSName | maltego.DNSName |
| dnsdbrrsetDomain | maltego.Domain |
[DNSDB] To A Records for this DNSName
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To A Records for this DNSName |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDNSNameToA |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To AAAA Records for this DNSName
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To AAAA Records for this DNSName |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDNSNameToAAAA |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To MX for this DNSName
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To MX for this DNSName |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDNSNameToMX |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To NS for this DNSName
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To NS for this DNSName |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDNSNameToNS |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To SOA Records for this DNSName
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To SOA Records for this DNSName |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDNSNameToSOA |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To SRV Records for this DNSName
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To SRV Records for this DNSName |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDNSNameToSRV |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To TXT Records for this DNSName
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To TXT Records for this DNSName |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDNSNameToTXT |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup MX for this Domain
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup MX for this Domain |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDomainMX |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup NS for this Domain
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup NS for this Domain |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetDomainNS |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To DNSNames from this email
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To DNSNames from this email |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetEmail |
| Input Entities | maltego.EmailAddress |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] MX from E-mail address
| False | | API Key | False | True | string |
| Display Name | [DNSDB] MX from E-mail address |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetEmailMX |
| Input Entities | maltego.EmailAddress |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] To DNSNames from this URL
| False | | API Key | False | True | string |
| Display Name | [DNSDB] To DNSNames from this URL |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetURL |
| Input Entities | maltego.URL |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$dnsname
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$dnsname |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclDNSName |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$dnsname/A
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$dnsname/A |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclDNSNameA |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$dnsname/AAAA
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$dnsname/AAAA |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclDNSNameAAAA |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$dnsname/CNAME
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$dnsname/CNAME |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclDNSNameCNAME |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$domain
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$domain |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclDomain |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$domain/A
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$domain/A |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclDomainA |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$domain/AAAA
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$domain/AAAA |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclDomainAAAA |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$domain/CNAME
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$domain/CNAME |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclDomainCNAME |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup *.$phrase
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup *.$phrase |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwclPhrase |
| Input Entities | maltego.Phrase |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup $dnsname.*
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup $dnsname.* |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrDNSName |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup $dnsname.*/A
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup $dnsname.*/A |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrDNSNameA |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup $dnsname.*/AAAA
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup $dnsname.*/AAAA |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrDNSNameAAAA |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup $dnsname.*/CNAME
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup $dnsname.*/CNAME |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrDNSNameCNAME |
| Input Entities | maltego.DNSName |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup $domain.*
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup $domain.* |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrDomain |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup $domain.*/A
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup $domain.*/A |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrDomainA |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup $domain.*/AAAA
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup $domain.*/AAAA |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrDomainAAAA |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] Lookup $domain.*/CNAME
| False | | API Key | False | True | string |
| Display Name | [DNSDB] Lookup $domain.*/CNAME |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrDomainCNAME |
| Input Entities | maltego.Domain |
| Output Entities | Phrase |
| Short Description | |
[DNSDB] lookup $phrase.*
| False | | API Key | False | True | string |
| Display Name | [DNSDB] lookup $phrase.* |
| Owner | Farsight Security |
| Author | support@farsightsecurity.com |
| Data Source | DNSDB |
| Transform Name | dnsdbrrsetwcrPhrase |
| Input Entities | maltego.Phrase |
| Output Entities | Phrase |
| Short Description | |