id: soa-detect

info:
  name: SOA Record Service - Detection
  author: rxerium
  severity: info
  description: |
    Detects which domain provider a domain is using, detected through SOA records
  reference:
    - https://www.cloudflare.com/learning/dns/dns-records/dns-soa-record/
  metadata:
    verified: true
    max-request: 1
  tags: dns,soa

dns:
  - name: "{{FQDN}}"

    type: SOA

    matchers-condition: or
    matchers:
      - type: word
        name: "cloudflare"
        words:
          - "dns.cloudflare.com"

      - type: word
        name: "amazon-web-services"
        words:
          - "awsdns"

      - type: word
        name: "akamai"
        words:
          - "hostmaster.akamai.com"

      - type: word
        name: "azure"
        words:
          - "azure-dns.com"

      - type: word
        name: "ns1"
        words:
          - "nsone.net"

      - type: word
        name: "verizon"
        words:
          - "verizon.com"

      - type: word
        name: "google-cloud-platform"
        words:
          - "googledomains.com"
          - "google.com"

      - type: word
        name: "alibaba"
        words:
          - "alibabadns.com"

      - type: word
        name: "safeway"
        words:
          - "safeway.com"

      - type: word
        name: "mark-monitor"
        words:
          - "markmonitor.com"
          - "markmonitor.zone"

      - type: word
        name: "hetznet"
        words:
          - "hetzner.com"

      - type: word
        name: "edge-cast"
        words:
          - "edgecastdns.net"
# digest: 490a00463044022100e0658df9a2f7efd0ea319be91ad620700abe63a21a91f83392745023b4ecda49021f085b47cc7716b161323ec23c4ea5d566b3b2dbaf1aa5d698e0be569bc81a11:922c64590222798bb761d5b6d8e72950