Tools · Attack surface inventory · 11 / 23
Amass: an address in the graph is a resolution, not a contract
An address next to a name in the Amass database is where that name resolved when the data was stored. Write the name, the address, and when it was read. A registry string is not an owner and not an intruder.
The pair is a stored resolution
When you read names and addresses back from the asset database, each pair is a resolution Amass stored. It is evidence that, at the time of that collection, the name was associated with that address in the data Amass kept. It is not a contract, a bill, or a promise the name still resolves there.
If you need “still resolves,” that is a new lookup at a new time, written beside the stored pair. Do not edit the old pair into the new fact.
A registry label is not an owner you can page
Looking up the address in whois can add a netblock and an organization string from the registry. That string names how the range is registered. It does not name the person who pays for the host, and it does not mean the host is outside your responsibility or inside it.
An unfamiliar organization string is a question for the contract list. It is not a finding that the host was taken over. Takeover is a claim you do not make from a registry line.
What to file
File the name, the address, the time you read the database or the collection time if you have it, and, if you used whois, the organization string labeled as registry text. File a fresh lookup separately if you made one. Do not write “compromised,” “attacker,” or “not ours” from the pair alone.
Worked case: a cloud range and a contract gap
The database shows files-lab.hackblue-lab.org with 203.0.113.50, read back on 2026-11-03. Whois for that address prints a cloud provider’s organization string. A draft says an outsider owns the host and it should be treated as hostile.
The note quotes the name, the address, the read-back time, and the registry string as registry text. A fresh lookup still returns 203.0.113.50. The contract register has no row for this name. The ticket asks who pays for it. It does not call the host compromised, and it does not say the registry string is the system owner.
read back: 2026-11-03 name: files-lab.hackblue-lab.org address in the database: 203.0.113.50 fresh lookup: 203.0.113.50 whois org: cloud provider (registry text) contract row: none write: ownership question, not a takeover
Diagram
A stored address versus a contract
The graph remembers a resolution. Finance remembers who pays.
Name and address. A resolution that was stored
When. The collection or the read-back time
Whois string. How the range is registered, if you looked
A payer. The contract register
Still true. Unless a new lookup says so
Hostile. A registry string is not an intruder
Check yourself
1. What does an address beside a name in the Amass database show?
2. The whois organization string names a cloud provider. What is that string?
3. You want to say the name still points at that address. What do you add?