A non-transitory computer-readable storage medium storing a detection program that causes a processor included in a noise estimation apparatus to execute a process, the process includes acquiring domain information included in cyber attack information, acquiring record information corresponding to the acquired domain information from a second managing server, the second managing server managing a response history of a first managing server by monitoring communication of the first managing server, the first managing server managing an association between domain information and an IP address, the response history being related to the association between the domain information and the IP address, identifying an IP address that is repeatedly used and a name server associated with the identified IP address by analyzing the record information, and outputting first list information indicating the identified IP address and the identified name server.