Domain registrar credentials

Detects domain registrar credentials: registrar account or transfer-code wording with populated login, password, PIN, API key or EPP/auth code values for managed domains. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated credential field (username/login, account/customer ID, password, PIN, API key, EPP/auth code) or a managed domain name), and 85 needs two distinct structures plus independent domain-administration (renewal/expiry, nameservers, registrant, WHOIS, registrar brand) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: credentials, security
Scope: wide
Risk rating: 5
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:domain\s+registrar(?:\s+(?:account|login|portal))?|registrar\s+(?:account|portal|login|credentials)|domain\s+(?:transfer|auth(?:orization)?)\s+code|EPP\s+(?:code|key)|auth[\s-]?info\s+code)\b

Corroborative evidence keywords

renewal, expiry, nameservers, registrant, WHOIS, DNS, two-factor, auDA, GoDaddy, Namecheap, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string (+43 more)

Proximity: 300 characters

Should match

Renewal notices from the domain registrar go to the ICT shared mailbox. — Discovery probe (65)
Domain registrar account Username: ict-admin@harbourhealth.org.au — Medium-tier probe (75) - populated login field
Domain registrar account - harbourhealth.org.au Customer ID: 40118273 Username: ict-admin@harbourhealth.org.au Password: Tide!Harbour2026 EPP code: zR7#kq2Lw9 Renewal due 14/03/2027; nameservers ns1.harbourdns.net; two-factor not enabled. — High-tier probe (85) - several credential fields, domain and administration context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: domain registrar credentials are held in the privileged password vault. — Policy text
Domain registrar account template Username: ________ Password: [insert] — Blank template
Course module 1: to move a domain, request the EPP code from your domain registrar and approve the transfer. — Training framing

Known false positives

Registrar help pages explain how to find an EPP or auth code. Mitigation: Values must be populated; guidance/training framing is excluded.