Abstract: The present application discloses a method, system, and computer system for detecting hijacked domains. The method includes (i) filtering a set of DNS records in real-time to filter out DNS records determined not to be associated with DNS hijacking and store an indication of a set of resultant filtered DNS records, (ii) detecting DNS hijacking records based at least in part on processing a batch of resultant filtered DNS records, and (iii) performing an active measure in response to detecting the DNS hijacking records. The set of resultant filtered DNS records are batched according to a predefined timeframe.

Abstract: Various techniques for automating WHOIS parsing and understanding with generative artificial intelligence are disclosed. In some embodiments, a system, a process, and/or a computer program product for automating WHOIS parsing and understanding with generative artificial intelligence includes receiving a WHOIS record (e.g., the WHOIS record can include unstructured data); processing the WHOIS record at least in part using a generative artificial intelligence (GenAI) model (e.g., including a Large-Language Model (LLM)) to determine a set of predefined data block values applied to meta information for parsing the WHOIS record; and generating an enriched version of the WHOIS record.

Abstract: Detection of strategically aged domains is detected. A set of initially benign aged dormant domains is determined as a list of candidate strategically aged domains. The list of candidate strategically aged domains is monitored for a change by a particular domain from a dormant domain status to an active status. In response to determining the change to active status of the particular domain, an action is taken with respect to the aged dormant domain.

Abstract: Detection of strategically aged domains is detected. A list of aged dormant domains is determined, including by evaluating passive Domain Name System (DNS) information. The list of aged dormant domains is monitored for a change by an aged dormant domain from a dormant domain status to an active status. In response to determining the change to active status of the aged dormant domain, an action is taken with respect to the aged dormant domain.

Abstract: Detection of strategically aged domains is detected. A list of aged dormant domains is determined, including by evaluating passive Domain Name System (DNS) information. The list of aged dormant domains is monitored for a change by an aged dormant domain from a dormant domain status to an active status. In response to determining the change to active status of the aged dormant domain, an action is taken with respect to the aged dormant domain.