Re: [weirds] I-D Action: draft-hollenbeck-dnrd-ap-query-00.txt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

These would be interesting in a number of malicious registration/forensics scenarios. For example, think about DGAs that generate names across multiple registries (like Conficker). Now think about trying to pattern match to see if there is a common registrar being used or exploited. 

Since many information flows identify IP addresses initially and either resolve to names later or not at all, I suspect that this, too, would be valuable for any investigator.

These would also be extremely valuable if consensus policy were to consider and add reseller objects to the data model. This is my personal opinion and speculative as well. My company and members of the broader community may think differently.

On Apr 30, 2012, at 11:09 AM, Hollenbeck, Scott wrote:

>> -----Original Message-----
>> From: weirds-bounces@ietf.org [mailto:weirds-bounces@ietf.org] On
>> Behalf Of Hollenbeck, Scott
>> Sent: Monday, April 30, 2012 9:57 AM
>> To: weirds@ietf.org
>> Subject: [weirds] FW: I-D Action: draft-hollenbeck-dnrd-ap-query-00.txt
>> 
>> FYI, all. This is the first cut at a draft to describe a query protocol
>> for name registries. Another document (or documents) to describe
>> response formats is in the works.
> 
> I've received a private note from someone suggesting that queries for registrar objects by ID and hosts by IP address should be included in this draft. Does that sound reasonable?
> 
> Scott
> _______________________________________________
> weirds mailing list
> weirds@ietf.org
> https://www.ietf.org/mailman/listinfo/weirds

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQEcBAEBAgAGBQJPnrdoAAoJEGwWiPOSXEFNexYH/2b7UdT43DojdsWGfzyqiW/A
+I9RIEYrcj7cD2R1bFahVtzk9HkbEWLI2LVjPMSHNqH4WrWknP3c/6HpxYtPJL+F
7g3Pecgc8ZeNI6f852FQ6xc5q80lfuBb6+cJf0TQASj/cpLlAelYH6aiGiRLcTW+
yVGbbIQAUBDvqk1T+PNmgZNKk4rP9V1+sSUWVlvlWH14UL89qforx5fuCXKmg+1Z
8qbAqBOwHXs90ZDfihEqGYg7BpNBhyhUUa5aUGVlZVklYpBgZlKPgVoKYXHUp7Hk
mliKx4dORwktr/6H0S5EgpNBv6v0vdrrz/8HWIpaVprWJB1HSFZGytyJiNVcbm8=
=gKA9
-----END PGP SIGNATURE-----