id: fbi-seized-nameserver

info:
  name: FBI Seized Nameserver - Detect
  author: rxerium
  severity: info
  description: |
    Detected domains whose nameservers have been seized by law enforcement (e.g., FBI), often indicating involvement in malicious or criminal activity.
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 1
    shodan-query: title:"THIS WEBSITE HAS BEEN SEIZED"
    fofa-query: title="THIS WEBSITE HAS BEEN SEIZED"
  tags: dns,ns,darkweb,fbi,seized

dns:
  - name: "{{FQDN}}"
    type: NS

    matchers:
      - type: word
        words:
          - "ns1.fbi.seized.gov"
          - "ns2.fbi.seized.gov"
          - "ns3.fbi.seized.gov"
          - "jocelyn.ns.cloudflare.com"
          - "plato.ns.cloudflare.com"
          - "ns1.usssdomainseizure.com"
          - "ns2.usssdomainseizure.com"
        condition: or

    extractors:
      - type: regex
        group: 1
        regex:
          - "IN\\tNS\\t(.+)"
# digest: 4a0a0047304502202fb53ebbe29788068825360dba8c06e54cc8f4a2ac5e7f346eeabdcdfabdfad5022100df8b95fe430aa4a44205d5effceac18cd46df4b0e1a419b9059b255b77366708:922c64590222798bb761d5b6d8e72950