Validin expanded its Advanced Search with broader registration filters and new regular-expression domain matching, making it easier to find related domains and IPs across registration, host, and DNS attributes. It also introduced a beta behavioral live scan that captures browser-rendered screenshots, full request artifacts, and HTTP2 activity for richer investigation context. #Validin #AdvancedSearch #LiveScan
Keypoints
- Validin improved the performance and scope of its Advanced Search experience in August.
- The new Advanced Search module now supports expanded registration criteria, including registrant, billing, tech, security, admin, and abuse contact details.
- Researchers can filter domains using regular expressions with the new =~ and !~ operators.
- The regex filtering helps analysts identify domains with lexicographic similarities or exclude matching patterns.
- Validin introduced a new beta “behavioral” live scan for domain names and IP addresses.
- The behavioral scan captures browser-rendered screenshots, a full request log, AJAX requests, and HTTP2 negotiation details.
- These updates are intended to help analysts narrow infrastructure datasets and collect richer evidence during investigations.
MITRE Techniques
- [T1593.001 ] Search Open Websites/Domains – Used to find domains matching registration, DNS, host response, or regex-based criteria (‘find domain names and IP addresses matching search criteria across combinations of registration, host response, and DNS attributes’).
- [T1595 ] Active Scanning – Used through live scan features that query domains and IPs over HTTP or HTTPS to collect responses (‘supports arbitrary paths and ports over either HTTP or HTTPS’).
- [T1217 ] Browser Session Hijacking / Web Session Monitoring – Not directly hijacking, but the behavioral scan captures browser-rendered behavior and loaded artifacts to inspect what users encounter (‘captures a fully rendered screenshot and a full response stack of collected artifacts’).
- [T1056.001 ] Keylogging – Not mentioned in the article.
Indicators of Compromise
- [Email Address] contact/search reference – [email protected]
- [URL / Service Name] product and feature reference – Validin, Advanced Search, live scan
- [Query Operators] regex filtering examples – =~, !~
Read more: https://www.validin.com/blog/advanced_search_live_scan_improvements/