User Seeks Help with TryHackMe Room "IP and Domain Threat Intel"

The user is stuck on three questions in Task 7 of the TryHackMe room. They provide hints for two questions: one mentions a nameserver (ns-298.awsdns-37.com), and another suggests checking historical WHOIS records from 2022. The user shares DNS records for santagift.shop, noting discrepancies in the number of nameservers (2) and the SOA record (aurora.ns.cloudflare.com), which don’t match expected answers. They also observe that WHOIS data shows a future registration date (January 16, 2026), raising concerns about domain re-registration.