To sign up for our daily email newsletter, CLICK HERE
The Domain Name System (DNS) is a crucial element that makes the Internet work the way we know it today. Without it, regular Internet users would have a hard time visiting websites, as they would have to memorize different Internet Protocol (IP) addresses.
This post looks at an essential part of the DNS—the DNS history.
What Is the DNS?
We can’t fully grasp what DNS history is without a basic understanding of the DNS protocol. We know that it is essential and that it’s part of what makes the Internet work. But what is the DNS?
The DNS is a naming system for all devices that connect to the Internet. Its primary goal is to assign human-readable names (example[.]com) to IP addresses (49[.]149[.]114[.]8), in a process called “DNS resolution.” All these happen in the background, and IP assignments could change from time to time. As such, keeping track of resolutions through a DNS database history is one of the most effective ways to make the Internet transparent.
What Is DNS History?
DNS history refers to the data about past DNS resolutions gleaned from a passive DNS (pDNS) database. pDNS is not an original part of how the DNS works. It only came about in 2005 out of the need to track historical DNS resolutions. Since then, pDNS has been an integral cybersecurity tool.
With a DNS history database, we know what domain names resolved to a particular IP address, and vice versa. For instance, more than 6,000 domains are connected to the IP address 23[.]227[.]38[.]65, including the following:
- 002imagery[.]com
- 001skincare[.]com
- 100senses[.]com
- 20survivors[.]com
- 3queensbling[.]com
- 5ambeauty[.]com
- 9yuan3[.]space
- aaselling[.]com
- aawcollectionz[.]com
Aside from past IP resolutions, DNS history data also includes date stamps when the domain name first and last resolved to a particular IP address. The domain aawcollectionz[.]com, for example, first resolved to 22[.]227[.]38[.]65 on 18 May 2020 and did so last on 15 January 2021. These date stamps provide additional context when investigating suspicious domain names and IP addresses. Furthermore, DNS history takes note of other DNS record details, such as nameservers and mail servers.
3 Uses of DNS History
Prevent Malware Attacks
Developers of malware are known to hard-code domain names within malicious files and applications. They then hide the command-and-control (C&C) server usually through fast-fluxing, which involves rapidly changing IP addresses associated with a single domain name.
Looking into DNS history can help detect this stealth technique. With a pDNS database, security teams can see domain names that resolve to an unusually high number of IP addresses. This data could mean that a malware attack is ongoing, and it could help determine which networks are infected. As such, the malware attack can be detected before it can do further damage.
Detect Possible Phishing Domains
A common characteristic of phishing domains is that they mimic those of reputable brands or companies. After all, an email from support@microsoftonlineservices[.]com[.]ru would be more believable than one that comes from aa123434df@gmail[.]com.
However, comparing the DNS history of the official Microsoft website and the look-alike domain would reveal inconsistencies. Unmatching historical DNS records could make phishing domains easier to detect.
Uncover Domain Associations
No matter how careful they are, cybercriminals tend to reuse part of their infrastructure. In fact, they may use multiple domain names in simultaneous attacks, with each sharing the same DNS infrastructure. As such, mapping out the digital footprint of a malicious domain name could reveal other domains used by the same threat actors.
The ability to look up the DNS history of a particular domain makes the Internet a lot more transparent. While it doesn’t stop threat actors from launching cyber attacks, DNS history helps make investigations more in-depth and comprehensive. It also enables security teams to be more proactive in their cybersecurity efforts by uncovering domain associations and possible malicious domains.
