Re: [weirds] I-D Action: draft-hollenbeck-dnrd-ap-query-00.txt

[Dave Piscitello <[e-mail]>]

On May 1, 2012, at 8:49 AM, Andy Newton wrote:

> 
> On May 1, 2012, at 8:03 AM, Dave Piscitello wrote:
> 
>> +1
>> 
>> In a searchable world, sometimes all you have is the IP of the name server that's resolving the malicious/harmful domain. So asking "what other domains host zone files at this IP?", "who registered those domains?", and "what registrar is sponsoring the registrations?" are all useful crumbs that often help you identify names used by in a campaign, or the registrant names used in association with a criminal enterprise. 
> 
> Are you gonna hit up every registry or registrar in the world looking for your answer? I'm a little fuzzy on the use case.

This would be inefficient. As I said in a subsequent email, at least some of the use cases I'm familiar with are databases of whois records associated with malicious registrations or domains associated with criminal activities. However, I wouldn't discount hitting up the "top suspects" if I were investigating a campaign that seemed to concentrate on a small number of registries. Sampling might fall within scale, too.

> And does this feature already exist in many registry Whois servers?

Few I imagine. I know of some research and private applications where this feature is either present or would be attractive. 

Are we only interested in replicating what exists today?