dns_ttl_analysis
Identifies DNS TTL anomalies across record types (fast-flux, stale cache, inconsistency) to expose security and operational risks.
Instructions
Analyze DNS TTL (Time-To-Live) values across all record types for a domain. Flags potential security and operational issues: TTL < 60s (fast-flux indicator, common in malware C2), TTL > 86400s (stale cache risk during incident response), and inconsistent TTLs across record types.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | The domain to analyze TTL values for (e.g. 'example.com') |