Expanded registration search criteria, regex domain filtering, and a new behavioral live scan.
Advanced Search and Live Scan Improvements
In August, we continued to improve the performance and the scope of supported functionality in our new Advanced Search experience. We also added a new beta live scan experience, which we’re calling a “behavioral” scan, that captures both a fully rendered screenshot and a full response stack of collected artifacts. Both of these features are available to all enterprise users as “beta” releases.
Expanded Registration Search Criteria
Our new Advanced Search module, which enables researchers and analysts to find domain names and IP addresses matching search criteria across combinations of registration, host response, and DNS attributes, now supports a much broader array of registration feature criteria. These criteria now include contact details for registrant, billing, tech, security, admin, and abuse contacts, including names, email addresses, phone numbers, locations, and other fields.
Figure 1. Validin’s query language now supports granular registration filters to enable improved ability to focus searches for domain names.
Filter Domains by Regex
Validin’s Advanced Search module also supports filtering by regular expression. This enables analysts and researchers to find domains that have lexicographic similarities in addition to registration, host response, or DNS overlap. This is supported by the addition of two new operators: =~ and !~, followed by a regular expression wrapped in forward-slashes (/).
To filter by domain names that match a specific regular expression pattern, add a query modifier at the end of the query using hostname =~ /<regex>/.
Figure 2. Validin’s Advanced Search query language supports filtering for domains matching a given regular expression using the =~ operator.
Analysts can also add negative filtering by regular expression to view only the results that do not match a specified lexicographic pattern. This is enabled by using the operator !~.
Figure 3. Validin’s Advanced Search query language also supports excluding domains that match a given regular expression using the !~ operator.
New Behavioral Scan
Validin now supports an additional “live scan” option for domain names and IP addresses. Like our existing live scan, this scan supports arbitrary paths and ports over either HTTP or HTTPS and will follow off-host redirects. However, this scan option provides additional capabilities, including:
- Screenshots of a browser-rendered page
- Full request log, including resources and AJAX (dynamic, JavaScript-initiated) requests
- Negotiation over HTTP2
Figure 4. Validin’s live scan now includes a behavioral option that includes screenshots of a browser-rendered response.
Our quick live scan option can be used to quickly capture responses in the same way that Validin measures host responses across the entire internet at an average rate of over half a million every minute. This enables you to compare how a host responds right now with other historical responses in our data.
Validin’s behavioral live scan complements our existing live scan option by providing richer context around how a browser actually behaves as it renders a website. Screenshots and artifacts enable evidence capture that can be valuable in investigations.
Figure 5. Validin’s behavioral live scan captures all artifacts loaded by the page, including those that require JavaScript or loaded from off-host sources. Full artifacts are available for download for local inspection.
Conclusion
These updates make it easier to narrow large infrastructure datasets and capture richer context when investigating live hosts. Expanded registration criteria and regex filtering give analysts more precise ways to identify related infrastructure, while behavioral scans provide a browser-level view of the pages and resources users actually encounter.
We’re continuing to expand our Advanced Search and live scanning capabilities during beta, and we’d love to hear how these features fit into your workflows. Reach out anytime at lets.talk@validin.com.