Domains that look similar to known organization are often used in phishing attacks and business email compromise (BEC) scams. Many cybersecurity companies offer brand monitoring and threat intelligence products to detect infringing (scam) domains. Nearly all brand detection products utilize root zone files as a core component. This blog post details how security firms obtain zone files from ICANN for utilization in their intelligence products.
The Internet Corporation for Assigned Names and Numbers (ICANN) is an international non-profit responsible for managing domain names. ICANN coordinates root name servers for TLDs. As part of this process ICANN maintains the Centralized Zone Data Service (CZDS) which publishes zone files.
A zone file is a text file that describes a DNS zone — usually a TLD. A zone file will list every registered domain in the TLD and any name servers associated with the domain.
And below are the zone file records for insomniac.tech:
CZDN centralizes access to most zone files. Any person with a legitimate need can request access to zone files for the various TLDs. Below is a screenshot of the CZDN portal.
Access to zone files is important for brand monitoring. A newly registered domain that’s similar to a known domain needs to vetted for potential abuse. By diffing zone files and running comparison algorithms, security firms can detect new imposter domains and alert businesses. This process is basic domain monitoring brand detection.
In a later post I’ll dig into the technical details to efficiently diff and search zone files, but the code is already available.
