0

I queried amazon.com using lookup API from DNSDB "https://api.dnsdb.info/lookup/rdata/name/amazon.com" and i got following response.

qlightingcontrol.in. IN NS amazon.com.

qlightingcontrol.com.tw. IN NS amazon.com.

rustaxi-cyprus.com. IN SOA amazon.com. root.example.com. 2017122837 3600 3600 604800 86400

transfer-cyprus.ru. IN SOA amazon.com. root.transfer-cyprus.ru. 2018022807 3600 3600 604800 86400

silver.buymyunicorns.com. IN CNAME amazon.com.

violet.buymyunicorns.com. IN CNAME amazon.com.

159.15.154.185.in-addr.arpa. IN PTR amazon.com.

116.213.123.195.in-addr.arpa. IN PTR amazon.com.

What does the above response indicate and what value can i get keeping in mind cyber security perspective?

P.S: Above response is truncated for illustration purposes.

closed as off-topic by Xander, kalina, forest, Stephane, Rory Alsop May 1 at 10:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – kalina, forest, Stephane, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I'm voting to close this question as off-topic or too broad. Essentially it says "please explain the various types of DNS records to me" which has nothing by itself to do with security. Only the add-on "...keeping in mind cyber security perspective" is related but actually requires that the OP first understands the (off-topic) part what these records mean in the first place. – Steffen Ullrich Apr 19 at 17:35
0

Your search appears to have returned a number of records referencing amazon.com. Of the records returned, most of them appear to be domains which aren't Amazon claiming to be resolved authoritatively by Amazon. (Put differently, Amazon had nothing to do with most of this).

qlightingcontrol.in. IN NS amazon.com.
qlightingcontrol.com.tw. IN NS amazon.com.

"Amazon.com is the name server for qlightningcontrol.(*)" - I don't see that those domains actually exist, and it's unlikely amazon.com would be their NS if they did.

rustaxi-cyprus.com. IN SOA amazon.com. root.example.com. 2017122837 3600 3600 604800 86400
transfer-cyprus.ru. IN SOA amazon.com. root.transfer-cyprus.ru. 2018022807 3600 3600 604800 86400

Start Of Authority records, again, claiming amazon.com is the NS. Unlikely, especially given the domain names involved, and the indication that "root@example.com" is the contact for one of them.

silver.buymyunicorns.com. IN CNAME amazon.com. 
violet.buymyunicorns.com. IN CNAME amazon.com.

Two CNAME, or Alias, records, meaning "If you want to go to (*).buymyunicorns.com, look up amazon.com and go to their IP address." These do, in fact, look real, albeit pointing off to Amazon AWS and not amazon.com:

$ host silver.buymyunicorns.com
silver.buymyunicorns.com is an alias for ec2-54-160-8-108.compute-1.amazonaws.com.
ec2-54-160-8-108.compute-1.amazonaws.com has address 54.160.8.108
$ host violet.buymyunicorns.com
violet.buymyunicorns.com is an alias for ec2-100-26-47-25.compute-1.amazonaws.com.
ec2-100-26-47-25.compute-1.amazonaws.com has address 100.26.47.25

Finally:

159.15.154.185.in-addr.arpa. IN PTR amazon.com.
116.213.123.195.in-addr.arpa. IN PTR amazon.com.

These PTR (or "Reverse DNS") records say "The name associated with 185.154.15.159 is amazon.com". Anybody can associate any name with their IP address, as long as they are allowed to update PTR records for that IP address. Looking at the rwhois data, though, I don't think that IP address is actually owned by Amazon.com:

inetnum:        185.154.15.128 - 185.154.15.255
netname:        NET-10-2
org:            ORG-ODL5-RIPE
country:        NL
remarks:        Server location - Netherlands, Dronten
source:         RIPE
...
organisation:   ORG-ODL5-RIPE
org-name:       ON-LINE DATA LTD
org-type:       OTHER
address:        Suite 1, Second Floor, Sound & Vision House, Francis Rachel Str.
address:        Victoria, Mahe, Seychelles

what value can i get keeping in mind cyber security perspective?

The value you should get from this is that DNS is full of ways to reference reputable domains, like Amazon, but there is no actual connection to Amazon in many cases and the records you see should be less trustworthy, rather than more, because of this misdirection.

Not the answer you're looking for? Browse other questions tagged or ask your own question.