(DT30) (INCYBER) De quelques jours à quelques secondes : L'évolution de l'intelligence Real-Time DNS

(DT30) (INCYBER) De quelques jours à quelques secondes : L'évolution de l'intelligence Real-Time DNS

by INCYBER

Applied Sciences & Engineering Computing & Cybersecurity UTComputer networking and communicationsUTNNetwork security
🎙 INCYBER 👥 7K 📅 April 12, 2026 ⏱ 33 min 👁 55 📄 expert opinion 🧭 2026-08-13
Available in: English (current) Français

Keywords

DNSreal-timethreat intelligencerisk scorephishing

Summary

The presentation by a DomainTools representative at the INCYBER Forum Europe 2026 introduces their real-time DNS intelligence capabilities. The speaker explains how DomainTools has been mapping internet DNS activity for 25 years, tracking changes in domain configurations. They emphasize the concept of domain lifecycle, where a domain can be registered for years but suddenly become active, triggering a new lifecycle and risk assessment. The risk score, ranging from 0 to 100, is based on factors like phishing, malware, spam, and proximity to known malicious infrastructure. The presentation includes live demos of their products: Iris Detect for brand protection and phishing detection, and Iris Investigate for deep-dive investigations. They showcase how to monitor look-alike domains, escalate suspicious ones, and pivot on indicators like IP addresses or website titles to uncover related malicious domains. A key innovation is IRISQL, a query language that simplifies complex filtering and enables easy sharing and integration with APIs. The talk concludes with a brief mention of MCP (Model Context Protocol) integration for AI, but the demo is cut short.

173 words

Critical Evaluation

Value of the Information & Strength of the Argument

The presentation provides valuable insights into the practical application of DNS data for cybersecurity. The speaker demonstrates the importance of real-time monitoring and the use of risk scores to prioritize threats. The argumentation is solid, based on the company’s extensive experience and data coverage. However, the talk is largely a product demonstration, so the value is more in showcasing capabilities than in providing independent analysis. The speaker effectively argues that DNS data is a rich source of threat intelligence, and the live demos illustrate the speed and utility of their tools.

Scientific Rigor, Source Quality, Title Accuracy

The presentation is scientifically rigorous in the sense that it relies on DomainTools’ proprietary data, which is a legitimate source for DNS intelligence. However, no external sources are cited, and the claims are not independently verified. The title accurately reflects the content, focusing on the evolution of real-time DNS intelligence. The talk is well-structured and the demos are convincing, but the lack of citations and the promotional nature of the content slightly reduce its scientific credibility.

182 words

Title / Content Match

The title accurately reflects the content, focusing on the evolution of real-time DNS intelligence and the speed of DomainTools' services.

Quality & Reliability

7/10

The speaker is a representative of DomainTools, a well-established company in DNS intelligence. The presentation is based on their proprietary data and tools, but lacks independent verification. The claims about real-time DNS monitoring and risk scoring are plausible but not backed by external studies.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Concurring Sources

  • DomainTools — Official website of DomainTools, the company behind the presented tools.

Contribution & Novelties

The presentation highlights DomainTools’ real-time DNS intelligence, which is a significant advancement in threat detection. The introduction of IRISQL is a novel approach to querying DNS data, making it more accessible and shareable. The risk score based on proximity to malicious infrastructure is a unique feature that allows proactive blocking. The talk also emphasizes the speed of detection, reducing response times from days to seconds.

Pour aller plus loin :

  • DomainTools — Official website of the company, providing more details on their products and services.
  • DNS-based threat intelligence — Wikipedia article on DNS-based threat intelligence, offering background on the concept.
  • IRISQL documentation — Blog post introducing IRISQL, though the URL is not verified; if uncertain, consider searching for ‘DomainTools IRISQL’ on their site.

123 words

Radar Profile

The radar profile shows high scores in information quantity and quality, reflecting the detailed and practical content. The technical level is moderate, suitable for a professional audience. The reliability score is slightly lower due to the promotional nature and lack of external verification.

Reliability 6/10