Validin Adds Faster Infrastructure Collection and Bulk Search for 1,000 Indicators
Summary
Validin says it improved collection of short-lived infrastructure, increased several DNS record scans from weekly to daily, added bulk search for up to 1,000 indicators, and redesigned Threat Profiles.
Key points
- Validin says its collection improvements captured DNS and host response data from a Brazilian bank-themed phishing domain that was online for about 12 hours.
- Scanning for TXT, MX, SRV, HTTPS, CAA, and SOA records increased from weekly to daily.
- Bulk Search lets analysts submit and enrich up to 1,000 indicators, with maliciousness and warning annotations and selectable data sources.
- Search jobs progress through queued, running, and completed states; results are organized into separate data tabs.
- Redesigned Threat Profiles include recent-activity sorting and daily indicator-count charts.
- Advanced Search data lookback is being reduced to 30 days to improve query performance.
Article Details
- Event Type
- Validin product update introducing improved data collection, daily DNS record scanning, bulk search for up to 1,000 indicators, and a redesigned Threat Profiles page.
- Impact
- The updates improve collection of short-lived infrastructure and historical visibility, enable analysts to enrich larger batches of indicators, and provide per-day indicator activity views. Advanced Search data lookback was reduced to 30 days to improve query performance.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | centralacessonu[.]online | Domain identified in the article as hosting pages that appear to be Brazilian bank phishing themed; it was online for about 12 hours. |