Domains, platforms, and web abuse
Domain monitoring
Domain monitoring is the continuous collection and review of domain registrations, DNS records, certificates and web content to find hostnames that imitate a brand or host abuse against it.
What gets watched
- New registrations that resemble the brand, from zone files and registration data.
- Certificate transparency logs, which record every publicly trusted certificate and reveal hostnames, including subdomains, as they are set up.
- DNS changes on known suspects: a parked domain that suddenly resolves to a hosting provider is about to be used.
- Page content on live hosts, to tell a phishing kit from a parking page.
From alert to action
A monitoring feed produces candidates; a person or a rule decides which ones matter. The useful output is a short list ranked by harm, each item carrying the evidence needed to report it: hostname, registrar, nameservers, IP and hosting provider, certificate, and a dated capture of the page. Monitoring without that packaging step produces alerts that nobody acts on.
Measuring it
Two numbers say whether monitoring is working: how long between a hostname first appearing in public data and the team seeing it, and how long between seeing it and the first report to a provider. Both should be measured on real cases, not on vendor claims.
Related terms
Sources
- MITRE ATT&CK T1583.001: Acquire Infrastructure, Domains
- CISA: understanding website certificates
- ICANN: Registration Data Access Protocol
External guidance is general. Adapt it to your legal, regulatory and operational requirements.