DataPulse Quick Reference

Tool Selection

DNS Response Patterns

Resolver: All DNS tools use a DNSSEC-validating recursive resolver with no content filtering, except that answers in private, link-local or unique-local ranges are dropped (DNS-rebinding protection). The specific resolver is not exposed or configurable.

Default (summary) — record found:

{"status": "ok", "dnssec_signed": true, "records": {"A": [{"name": "example.com.", "ttl": 3600, "data": {"address": "1.2.3.4"}}]}, "query_time_ms": 42}

NXDOMAIN:

{"status": "nxdomain", "records": {"SOA": [...]}, "query_time_ms": 15}

CNAME chains: Automatically resolved — both CNAME and final A/AAAA appear in records.

Full output: Set full=true for raw per-query flags, authorities, additionals, and RRSIG/NSEC records.

DNSSEC Validation

datapulse_live_dns returns DNSSEC status automatically (DO flag is set):

• Summary: dnssec_signed: true = Authenticated Data (DNSSEC valid)
• Full (full=true): flags.ad: true per query, RRSIG records in answers
• status: "servfail" often indicates DNSSEC validation failure
• Query DNSKEY/DS record types with full=true to trace the trust chain (the summary strips DNSSEC record types, so a summary-mode DNSKEY/DS query returns no records)

Common Record Types

SRV, PTR, TLSA, NAPTR, and SSHFP require specifying record_type in datapulse_live_dns. The default (omitted) queries A, AAAA, MX, NS, TXT, SOA, CNAME, CAA, DNSKEY, DS plus a _dmarc.<domain> TXT lookup (returned in the dmarc field).

RDAP / WHOIS Status Codes

Corpus Basics

Full detail: datapulse_help(topic="methodology").

History Service Types (dphistory)

Version types a (listed) / c (changed) / d (de-listed) are listing events (passed / stopped passing the quality gate), not registry events. The timeline is a change log from 2023-04-07, mostly month-dated; services is [] for a d. Input is canonicalized (case, whitespace, IDN, trailing dots) but the hostname level is kept: www.github.com and github.com are different lookups (only the RDAP tools reduce hostnames; see datapulse_help(topic="normalization")). A never-listed name answers found: false with a hint. Same-hostname, different-ASN c versions are usually anycast churn, not moves. See datapulse_help(topic="history").

Tech Similarity (dptechsim)

Similarity Signals (what the embedding captures):

• Nameservers (operational + reported) and their ASNs
• MX records and mail server ASNs
• A/AAAA record ASNs (web hosting)
• TLD, registrar IANA ID, registration date

Score Interpretation:

Caveat: Major CDNs (Cloudflare ASN 13335, AWS, Google) cause many false positives. Look for rare ASN overlaps in the response fingerprint fields.

Response Fields:

• name, cosine_similarity - domain and score
• fpons, fpons_asn - operational nameserver fingerprint
• fprns, fprns_asn - reported nameserver fingerprint
• fpmx, fpmx_asn - mail exchanger fingerprint
• fpaw_asn - web hosting ASN fingerprint
• registrar_iana_id, registration_date

Workflow Patterns

Domain Research (start here)

datapulse_domain_overview(domain="suspicious.com")
→ Scrape + DNS + RDAP in one call. Then pivot with the specialized tools below.

Investigation Pivot

dptechsim(suspicious.com, 0.90) → filter rare ASNs → dphistory(matches) → live_rdap(top hits)

Typosquatting Analysis

searchlabels("brand") → dptechsim(top_hits, 0.95) → group by registrar → live_rdap(clusters)

Operator Attribution

dptechsim(known_domain, 0.95) → filter by registrar_iana_id → dphistory for timeline

Bulk Registration Monitoring

regclusters(date, min_cluster_size=50) → identify unfamiliar registrars
→ regclusters(date, registrar_id=XXXX) → get full domain list for that registrar
→ dptechsim(sample_domains) → live_rdap(suspicious)

Malicious Bulk Registration Triage

regclusters(date, min_cluster_size=50) → flag unknown/abuse-friendly registrars
→ Check sample_domains for DGA, brand abuse, high-abuse TLDs (.top, .icu, .sbs)
→ regclusters(date, registrar_id=XXXX) → examine full list + timestamps
→ dptechsim(2-3 samples, 0.90) → shared infrastructure = coordinated campaign
→ scrape_submit(sample) → parked/phishing/redirect = confirmed malicious
See: datapulse_help(topic="malicious_bulk_regs")

Domain Dispute Analysis

searchlabels("brandname") → find lookalike/typosquatting labels + TLD spread
→ live_rdap(suspect_domain) → registration details, registrar, dates
→ disputedb_search("confusing similarity <trademark> <domain>") → case precedents
→ disputedb_search("bad faith <specific circumstances>") → bad faith factors
→ disputedb_search("legitimate interests <respondent argument>") → defenses
See: datapulse_help(topic="disputedb")