id: fbi-seized-nameserver

info:
  name: FBI Seized Nameserver - Detect
  author: rxerium
  severity: info
  description: |
    Detected domains whose nameservers have been seized by law enforcement (e.g., FBI), often indicating involvement in malicious or criminal activity.
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 1
    shodan-query: title:"THIS WEBSITE HAS BEEN SEIZED"
    fofa-query: title="THIS WEBSITE HAS BEEN SEIZED"
  tags: dns,ns,darkweb,fbi,seized,discovery

dns:
  - name: "{{FQDN}}"
    type: NS

    matchers:
      - type: word
        words:
          - "ns1.fbi.seized.gov"
          - "ns2.fbi.seized.gov"
          - "ns3.fbi.seized.gov"
          - "jocelyn.ns.cloudflare.com"
          - "plato.ns.cloudflare.com"
          - "ns1.usssdomainseizure.com"
          - "ns2.usssdomainseizure.com"
        condition: or

    extractors:
      - type: regex
        group: 1
        regex:
          - "IN\\tNS\\t(.+)"
# digest: 4a0a0047304502203bfa4b127b9dd0676f2bef2f6a98437e138110c4fcd0fab7228b198c02b1455602210083c31901265fb5f043de7f01685f35fa46b7f0a5eb0abaa6ed031744dab24df3:922c64590222798bb761d5b6d8e72950