Re: [weirds] I-D Action: draft-hollenbeck-dnrd-ap-query-00.txt

[Dave Piscitello <[e-mail]>]

On Apr 30, 2012, at 5:21 PM, Eric Brunner-Williams wrote:

On 4/30/12 12:01 PM, Dave Piscitello wrote:
These would be interesting in a number of malicious registration/forensics scenarios. For example, think about DGAs that generate names across multiple registries (like Conficker). Now think about trying to pattern match to see if there is a common registrar being used or exploited.

i made, or thought i made, the point

Yes, you did. I'm expanding that to considering the volumes of registration data that people o/t registries and registrars store. Individual investigators, researchers in academia or organizations that have tens of thousands of whois records associated with malicious registrations, phished domains, malware hosting domains, etc. At the moment, much of this information is not easily normalized. Also, certain companies provide historical whois as a service. All of these would benefit from structured, searchable data, and there's keen interest in registrar and reseller info. The 2H2012 APWG Global Phishing Survey, for example, made use of Domain Tools historical Whois to identify "phished registrars" (Presented last week during APWG Prague, I wrote about it today).


Since many information flows identify IP addresses initially and either resolve to names later or not at all, I suspect that this, too, would be valuable for any investigator.

These would also be extremely valuable if consensus policy were to consider and add reseller objects to the data model. This is my personal opinion and speculative as well. My company and members of the broader community may think differently.

your company? that would be the rhs of "[e-mail]<mailto:[e-mail]>"?

Apologies, that is ambiguous. In this case, I'm speaking of ICANN.
I suspect no one at Core Competence disputes my opinion but I did send this from the ICANN address not [e-mail]<mailto:[e-mail]> :-)