Nameserver-based searches can uncover related domains that conventional phishing monitoring misses. An investigation of shared DNS infrastructure reveals how registration patterns, nameserver pairs and timely zone data can help identify suspicious domain clusters.