Farsight Security Blog Archive

Hunting for synthetic substances using DNSDB Search

Thursday, July 15, 2021 By Boris Taratine

Year-by-Year TLD Volumetric Data Covering A Decade

Monday, June 28, 2021 By Joe St Sauver

What's a UUID?

Tuesday, June 22, 2021 By Joe St Sauver

Opt What?

Monday, June 14, 2021 By Paul Vixie

Farsight DNSDB Transforms for Maltego with Flexible Search Now Available

Tuesday, June 8, 2021 By Robert Duran

New UI Names for Farsight DNSDB Transforms for Maltego

Thursday, June 3, 2021 By Ben April

New Report: DNS Network Traffic Volumes During the Pandemic: April 2020-March 2021

Wednesday, June 2, 2021 By Joe St Sauver

New COF2MISP import module for MISP enables Threat Hunters to improve Cybersecurity Investigations

Friday, May 28, 2021 By Boris Taratine, Aaron Kaplan, Alexandre Dulaunoy, Christian Studer

Introducing DNSDBFront for Real-Time Investigations

Thursday, May 20, 2021 By Henry Stern

Introducing Farsight Workbench for Threat Hunters

Wednesday, May 12, 2021 By Karen Burke

New Report: A Decade of Passive DNS: A Snapshot of Top-Level Domain Traffic

Tuesday, May 4, 2021 By Joe St Sauver

Two DNS Dudes with a ‘tude Dissect the NAME:WRECK Vulnerability in Episode One of New Streaming Series

Tuesday, April 20, 2021 By Farsight Security and ThreatSTOP

Threat Hunting Using Farsight Historical Passive DNS observations via the Malware Information Sharing Platform (MISP)

Thursday, April 1, 2021 By Boris Taratine and Alexandre Dulaunoy

Limiting DNSDB Results: dnsdbq little ell vs big ell

Tuesday, March 30, 2021 By Joe St Sauver

New dnsdbq Options: ASN Tagging and New Output Transforms Added

Thursday, March 25, 2021 By Joe St Sauver

Illuminating Signposts and Guidelines for a More Secure Internet

Wednesday, March 17, 2021 By Dr. Paul Vixie

Navigating Cybersecurity Rough Seas: Choosing Objective Observations vs Narrative Fallacies

Wednesday, March 10, 2021 By Boris Taratine

Building A Tabbed Graphical Interface in Python3 for DNSDB

Tuesday, March 2, 2021 By Joe St Sauver

Malware Information Sharing Platform (MISP) Now Offering Farsight DNSDB Flexible Search Capabilities

Wednesday, February 24, 2021 By Boris Taratine and Christian Studer

Farsight Returns to NICAR for Third Year

Monday, February 22, 2021 By Karen Burke

Investing in Cybersecurity's Future: The UK Cyber 9/12 Strategy Challenge

Wednesday, February 3, 2021 By Boris Taratine

Our New Scrolling Domain Widget

Tuesday, February 2, 2021 By Henry Stern

Farsight DNSDB: Mapping Privacy in the DNS

Thursday, January 28, 2021 By Ben April

Use of Passive DNS in multidisciplinary teams’ collaboration

Wednesday, January 27, 2021 By Boris Taratine

Explaining Passive DNS To Family Members

Tuesday, December 22, 2020 By Joe St Sauver

The Power of Why

Wednesday, November 25, 2020 By Ben April

These Days Some Of The Bad Guys Are Even Spoofing FBI-Related Domain Names...

Tuesday, November 24, 2020 By Joe St Sauver

Creating a DNSDB-Flexible-Search-To-DNSDB-Standard-Search Pipeline With 0mq

Friday, October 30, 2020 By Joe St Sauver

Using 0mq to Plumb a Simple Intermediate Layer for a DNSDB Client/Server Application

Tuesday, October 27, 2020 By Joe St Sauver

DNSDB 2.0 Flexible Search is Now Available!

Tuesday, October 20, 2020 By Tyler Wood

Identifying Possible Spoofed Domains In Minutes

Tuesday, October 13, 2020 By Karen Burke

National Cybersecurity Awareness Month 2020 and The Domain Name System (DNS)

Thursday, October 1, 2020 By Joe St Sauver and Ben April

Reducing Risk in a Fast-Changing World

Monday, September 21, 2020 By Karen Burke

Introducing DNSDB 2.0

Tuesday, August 4, 2020 By Tyler Wood

What's a Regular Expression?

Tuesday, August 4, 2020 By Joseph St Sauver

What is Globbing?

Tuesday, August 4, 2020 By Joe St Sauver

Cybersecurity and the Boardroom: What's Next in the Post-COVID Economy

Monday, June 22, 2020 By Karen Burke

New Farsight Security Research: DNS Network Traffic Volumes During the 2020 Pandemic

Wednesday, May 27, 2020 By Joe St Sauver

Early Security Lessons Learned from a Worldwide Crisis

Monday, May 18, 2020 By Daniel Schwalbe

Introduction to SIE Channel 115: DDoS Events

Thursday, May 14, 2020 By Joe St Sauver

Managing Remote Teams in Interesting Times

Monday, April 27, 2020 By Ben April

Using DNS Search to Uncover Phishing Infrastructure

Thursday, April 9, 2020 By Karen Burke

Researchers and Journalists: Searching for Common Ground

Monday, April 6, 2020 By Karen Burke

Using The SIE Batch API to Find Matching Names in Newly Observed Domains (NOD)

Wednesday, April 1, 2020 By Joe St Sauver

Tax Scammers: Gone Phishing This Tax Season

Monday, March 30, 2020 By Emanuel Younanzadeh

Investigating the U.S. Census Domain Using Passive DNS

Friday, March 27, 2020 By Eric Ziegast

New Whitepaper: Working With The SIE Batch API: A Command Line Client In Ruby, Perl, Python and C

Thursday, March 26, 2020 By Joe St Sauver

SIE Batch API: A libcurl example in C ("sie_get")

Monday, March 23, 2020 By Joe St Sauver

Best Practices for Data Diaries in Investigative Journalism and Beyond

Monday, March 16, 2020 By Karen Burke

What's SIE Batch? Why Might I Be Interested In It?

Thursday, February 20, 2020 By Joe St Sauver

Revving Up RSA Conference 2020 with Farsight's Real-Time Innovations

Wednesday, February 12, 2020 By Karen Burke

Getting a Running Start with the NVIDIA Jetson Nano

Friday, January 24, 2020 By Joe St Sauver

Batch mode and raw query updates to dnsdbq

Monday, January 13, 2020 By David Waitzman

Searching for the Truth in 2020 and Beyond using Farsight Passive DNS

Friday, December 13, 2019 By Karen Burke

Why Do Incident Responders and Other Investigators Focus on Particular DNS Record Types?

Friday, November 22, 2019 By Joe St Sauver

‘Tis the Season – to Counterfeit?

Friday, November 8, 2019 By Karen Burke

Newly Registered Domains vs. Newly Observed Domains vs. Newly Active Domains vs. Newly Observed Hostnames vs. DNS Changes: What Does "New" Mean?

Thursday, October 24, 2019 By Joe St Sauver

DNSDB Scout Turns 1!

Thursday, October 17, 2019 By Tyler Wood and Daniel Schwalbe

Shortening Dwell Time Using Farsight Passive DNS

Tuesday, October 15, 2019 By Karen Burke

Visualizing the Hard-to-Visualize: DNS and SSL/TLS Cert Existence Over Time Using R Graphics

Monday, September 30, 2019 By Joe St Sauver

Crushing Monolithic Data Results ("Rock") Into "Gravel": dnsbq New -g Volume-Across-Time Option

Friday, September 27, 2019 By Joe St Sauver

Getting More Results from DNSDB Using the New -O (Offset) Option

Tuesday, September 24, 2019 By Joe St Sauver

Rejecting Spam and Unwanted Email with NOD and RPZ

Wednesday, September 18, 2019 By Jeremy C. Reed

New DNSDB -V summarize option: Sometimes "Less" Is "More"

Tuesday, September 10, 2019 By Joe St Sauver

Blazing a New Path for Defenders at Black Hat USA

Monday, August 5, 2019 By Karen Burke

Farsight Security Introduces New Search Capabilities for DNSDB

Thursday, August 1, 2019 By Karen Burke

Running Bulk Queries in DNSDB For A File of IP Addresses

Monday, July 29, 2019 By Joe St Sauver

Creating Pandas Dataframes and CSV Files from DNSDB API Output Using Python3

Tuesday, July 23, 2019 By Joe St Sauver

A Second Approach To Automating Detection of "Random-Looking" Domain Names: Neural Networks/Deep Learning

Tuesday, July 9, 2019 By Joe St Sauver

Tracking the DNS Stars: The DNS Observatory

Monday, June 10, 2019 By Pawel Foremski

Using DNSDB With openssl s_client To Scan A List of Hosts For Expired SSL/TLS Certificates

Wednesday, May 29, 2019 By Joe St Sauver

Automating Detection of "Random-Looking" Algorithmic Domain Names

Friday, May 17, 2019 By Joe St Sauver

Analyzing DNSDB Volume-Over-Time Time Series Data With R and ggplot2 Graphics (Part Three of a Three-Part Series)

Thursday, April 18, 2019 By Joe St Sauver

Volume-Over-Time Data From DNSDB Export MTBL Files (Part Two of Three-Part Series)

Monday, April 1, 2019 By Joe St Sauver

Fighting Phishing: What You Need to Know

Monday, March 25, 2019 By Karen Burke

Finding Top FQDNs Per Day in DNSDB Export MTBL Files (Part One of a Three Part Series)

Friday, March 22, 2019 By Joe St Sauver

Poison Pivots

Thursday, March 14, 2019 By Joe St Sauver

Farsight Security Debuts Grant Program for Investigative Reporters

Wednesday, March 6, 2019 By Karen Burke

Introducing DNSDB Community Edition: Why Internet History Matters in DFIR

Tuesday, February 26, 2019 By Karen Burke

Campaigning for A More Secure 2020 Election

Thursday, February 14, 2019 By Karen Burke

Is Cyberinsurance Right For Your Organization?

Monday, February 11, 2019 By Karen Burke

Running dnsdb_query.py Under termux on Android

Thursday, February 7, 2019 By Joe St Sauver

RSA Conference 2019: Why DNS-Based Attacks Remain Top Security Concern for CISOs

Monday, February 4, 2019 By Karen Burke

DNSDB Scout™ for Firefox Is Now Available

Thursday, January 31, 2019 By Tyler Wood and Daniel Schwalbe

A View from Europe: GDPR and The Future of Data Privacy

Monday, January 28, 2019 By Karen Burke

A Quick Guide to Farsight's Grant Program

Tuesday, January 22, 2019 By Kelly Molloy

Getting "Human" (ISO8601) Datetime Stamps From dnsdbq JSON lines-formatted Output

Tuesday, October 30, 2018 By David Waitzman

Farsight DNSDB Bundles with Maltego To Enable Faster Investigations

Tuesday, October 23, 2018 By Karen Burke

DNSDB Scout – Farsight’s new Google Chrome Extension for DNSDB

Wednesday, October 17, 2018 By Tyler Wood and Daniel Schwalbe

Bulk Converting Internationalized Domain Names to Punycode With Perl and Net::IDN::Encode for Use With DNSDB

Tuesday, September 18, 2018 By Joe St Sauver

ASN-To-Prefixes-To-Domain Names -- Update to May 2017 Blog Article

Tuesday, September 4, 2018 By Joe St Sauver

The Only Thing That's Constant Is Change: The DNS Changes Channel (SIE Channel 214)

Monday, August 27, 2018 By Joe St Sauver

Free Airline Tickets: The Latest Internationalized Domain Name-based Homograph Scam

Monday, August 13, 2018 By Mike Schiffman

Malformed Internationalized Domain Name (IDN) Leads to Discovery of Vulnerability in IDN Libraries

Wednesday, July 11, 2018 By Mike Schiffman

IPs, Address Ranges, and CIDR Block Queries in DNSDB API

Friday, June 1, 2018 By Joe St Sauver

Organizational Announcement

Thursday, May 17, 2018 By Paul Vixie and Merike Kaeo

8 Common DNSDB "Pivots" for Threat Hunting

Thursday, May 3, 2018 By Joe St Sauver

"Black Box" Testing with the Python Black Box Tool (pbbt)

Monday, March 26, 2018 By Joe St Sauver

Using Farsight's dnsdbq Command Line DNSDB Tool in a Microsoft Windows Environment: The "Windows Subsystem for Linux" Option

Thursday, March 15, 2018 By Joe St Sauver

The "Forgotten Half" of DNSDB: DNSDB's DNSSEC Coverage

Thursday, March 8, 2018 By Dr. Paul Vixie and Joe St Sauver

Real-time Collaboration, Real-time Investigation with Farsight DNSDB and Polarity

Tuesday, February 27, 2018 By Karen Burke

Farsight's DNSDB Time Fencing: A Post-Attack "Time Machine"

Monday, February 12, 2018 By Joe St Sauver

Touched by an IDN: Farsight Security shines a light on the Internet's oft-ignored and undetected security problem

Wednesday, January 17, 2018 By Mike Schiffman

Increase Incident Response Speed and Accuracy with Farsight DNSDB and Demisto Enterprise

Tuesday, January 9, 2018 By Karen Burke

All I Want for Christmas is a New TLD

Wednesday, December 20, 2017 By Ben April

Farsight DNSDB Now Available on Malware Information Sharing Platform (MISP)

Tuesday, December 12, 2017 By Karen Burke

Timeless Gifts for the CISO in your Life

Friday, December 8, 2017 By Daniel Schwalbe

A Quick Overview of the Top Seven DNS Record Types

Friday, December 1, 2017 By Joe St Sauver

The Registration Data Access Program (RDAP), Whois And You

Friday, November 17, 2017 By Joe St Sauver

5 Tips for Threat Hunting with Farsight DNSDB

Wednesday, October 18, 2017 By Ben April

How Many "Parts" (or "Labels") Does A Domain Name Typically Have?

Friday, October 13, 2017 By Joe St Sauver

The Value of a Brand Domain Name — Priceless

Thursday, October 5, 2017 By Karen Burke

Zone Walking (Zone Enumeration via DNSSEC NSEC Records)

Friday, September 1, 2017 By Joe St. Sauver

CAA Records: An Alternative to DANE for Protecting SSL/TLS Certificate Users

Friday, August 25, 2017 By Joe St. Sauver

The Anti-Phishing Working Group (APWG)'s Global Phishing Survey: Farsight's Take On A Terrific Report

Tuesday, July 11, 2017 By Joe St. Sauver, Karen Burke

Visualizing the incidence of IPv4 addresses in Farsight's DNSDB

Wednesday, June 7, 2017 By Ben April

Automatically Going From An Autonomous System Number (ASN), To The Prefixes It Announces, To The Domain Names Seen Using Those IPs: Another Farsight DNSDB API Demo Application and Whitepaper

Wednesday, May 31, 2017 By Joe St. Sauver

New Farsight White Paper Available For Download: Building a Demo GUI Front End for DNSDB API In Scala

Tuesday, May 16, 2017 By Joe St. Sauver

Five Questions with Andrew Lewman

Friday, April 14, 2017 By Andrew Lewman

Performing Regex Searches Against DNSDB MTBL Files

Tuesday, April 11, 2017 By Joe St. Sauver

What is a Bailiwick?

Tuesday, March 21, 2017 By Joe St. Sauver

RECORD TYPE=NULL Records In DNSDB Mtbl Files

Wednesday, March 8, 2017 By Joe St. Sauver

Farsight's Network Message: Loss Tracking Explained

Friday, February 24, 2017 By Mike Schiffman

Creating a Heatmap From SIE Channel 204 Data

Thursday, January 26, 2017 By Joe St. Sauver and Ben April

Geolocating & Mapping IP Address Data From SIE

Monday, January 16, 2017 By Joe St. Sauver

Farsight's DNSDB Plugin for Splunk

Wednesday, December 7, 2016 By Joe St. Sauver

Raw Hex Rdata Queries: An Obscure (But Potentially Quite Useful) Bit Of DNSDB Functionality

Friday, November 25, 2016 By Joe St. Sauver

Making Programmatic DNSDB Queries With libcurl

Friday, November 4, 2016 By Joe St. Sauver

Remote Profiling of go Programs

Friday, October 28, 2016 By Chris Mikkelson

Farsight's Advanced Exchange Access: The Missing Manual

Thursday, October 20, 2016 By Mike Schiffman

Visualizing SIE Channel 204 Rdata

Friday, October 7, 2016 By Joe St. Sauver

Pick a Side, Pick a Site

Wednesday, September 21, 2016 By Farsight Security, Inc

Non-U.S. Universities with .edu Domain Names: They're More Common Than You Might Think

Thursday, August 25, 2016 By Joe St. Sauver

Introduction to Farsight's NOD RPZ

Wednesday, July 6, 2016 By Kelly Molloy

Accessing Darknet Telescope Data via SIE Remote Access (SRA)

Monday, June 13, 2016 By Joe St. Sauver

Spotting A DNS Denial of Service Reflection Attack in SIE Darkspace Telescope Data

Friday, June 3, 2016 By Joe St. Sauver

Smarter JSON Configs in Go

Monday, May 23, 2016 By Chris Mikkelson

IP Hijacking, part 2

Thursday, May 12, 2016 By Dave Hauser

Magical Thinking in Internet Security

Thursday, April 28, 2016 By Dr. Paul Vixie

IP Hijacking, part 1

Thursday, April 21, 2016 By Dave Hauser

Fun With Go Method Routing

Tuesday, April 12, 2016 By Chris Mikkelson

The Magic of SRV Records

Monday, March 28, 2016 By Joe St. Sauver

The Importance of Scale: A Critical Dimension To Keep In Mind When Benchmarking Passive DNS Options

Thursday, March 17, 2016 By Joe St. Sauver

What (Besides NXDOMAINs) Do We See on Farsight Security's DNS Errors Channel?

Friday, February 5, 2016 By Joe St. Sauver

Good Help is Hard to Find

Thursday, January 14, 2016 By Ben April

IPv6 Deployment Over Time As Seen Through Farsight Security, Inc's Passive DNS Data

Thursday, December 10, 2015 By Joe St. Sauver

Hardening Encrypted Communications Against Diffie-Hellman Precomputation Attacks

Wednesday, December 2, 2015 By Travis Hall

Farsight's Real-time DNSDB, Part Two

Wednesday, November 18, 2015 By Eric Ziegast

Farsight's Real-time DNSDB, Part One

Wednesday, October 28, 2015 By Eric Ziegast

JSON Serialization Support in nmsg

Friday, October 16, 2015 By Henry Stern

How Some People Got Started in Security and Anti-Abuse Work: Anybody Remember Usenet?

Friday, October 9, 2015 By Joe St. Sauver

Conficker and a Brief Tutorial on Working With SIE Channel 80 Sinkhole Data

Friday, October 2, 2015 By Joe St. Sauver

Farsight's Advanced Exchange Access Internals: Understanding Accounting

Thursday, September 24, 2015 By Mike Schiffman

Systematically Collecting The Right Sort of Data About Cyber Security Incidents

Thursday, September 17, 2015 By Joe St. Sauver

Finding Web Proxy Auto Discovery Protocol (WPAD)-related Security Exposures Using Farsight Security's NXDOMAINs Channel

Wednesday, September 9, 2015 By Joe St. Sauver

Farsight's Advanced Exchange Access: 1.2.0 Release Notes

Wednesday, September 2, 2015 By Mike Schiffman

Being an Internet Packrat

Wednesday, August 26, 2015 By Eric Ziegast

Introducing NXD

Thursday, August 20, 2015 By Chris Mikkelson

Newly Observed Hostnames

Wednesday, August 12, 2015 By Joe St. Sauver

Introduction to DNS Changes

Tuesday, August 11, 2015 By Henry Stern

Farsight's Advanced Exchange Access: The C Programming API, Part Three

Tuesday, August 11, 2015 By Mike Schiffman

Farsight's Advanced Exchange Access: The C Programming API, Part Two

Friday, August 7, 2015 By Mike Schiffman

Farsight's Advanced Exchange Access: The C Programming API, Part One

Thursday, July 30, 2015 By Mike Schiffman

Optimizing Reputation System Input Data

Friday, July 24, 2015 By Kelly Molloy

Building a Reputation System From Available Data

Wednesday, July 15, 2015 By Kelly Molloy

Introduction to Reputation Systems

Thursday, July 9, 2015 By Kelly Molloy

Threat Intelligence and The DIKW Pyramid

Wednesday, July 1, 2015 By Ben April

Buying More Nines Worth of Protection

Wednesday, June 24, 2015 By Joe St Sauver

Spamtraps: Creating and Seeding

Thursday, June 18, 2015 By Kelly Molloy

Spamtraps: Keeping it Confidential

Wednesday, June 10, 2015 By Kelly Molloy

Demystifying Spamtraps

Wednesday, June 3, 2015 By Kelly Molloy

So What's The Big Deal About New Domains?

Friday, May 29, 2015 By Joe St Sauver

Distributed Firewall Configuration Part 2: Ferm Configuration with Salt

Wednesday, May 20, 2015 By Travis Hall

Distributed Firewall Configuration Part 1: Salt and Pillars

Thursday, May 14, 2015 By Travis Hall

NMSG and JSON encoding

Wednesday, May 6, 2015 By Mike Schiffman

IPv6 Deployment and Finding IPv6 Needles in Internet Haystacks: Passive DNS & IPv6 Address Discovery

Wednesday, April 29, 2015 By Joe St Sauver

Illuminating online infrastructure for counterfeit goods

Thursday, April 23, 2015 By Eric Ziegast

Google Protocol Buffer Deserialization The Hard Way

Friday, April 17, 2015 By Mike Schiffman

NOD and Greylisting

Wednesday, April 8, 2015 By Joe St Sauver, Ph.D.

Internet Nations

Tuesday, March 31, 2015 By Paul Vixie, Ph.D.

Red Canary Announces Farsight Security As Inaugural Technology Partner

Thursday, March 26, 2015 By Karen Burke

Processing Passive DNS With the nmsg C API

Wednesday, March 18, 2015 By Chris Mikkelson

RRset and Rdata Demystified

Wednesday, March 11, 2015 By Joe St Sauver, Ph.D.

Help The Internet -- And Yourself -- By Running a Passive DNS Sensor Node and Contributing Data To The Farsight Security DNS Database (DNSDB)(tm)

Wednesday, March 4, 2015 By Joe St Sauver, Ph.D.

Farsight's Network Message, Volume 5: The Python Programming API

Wednesday, February 25, 2015 By Mike Schiffman

In Memoriam of Ellen Rosintoski

Saturday, February 21, 2015 By Kelly Molloy

Farsight's Network Message, Volume 4: The C Programming API

Wednesday, February 18, 2015 By Mike Schiffman

Network Message, Volume 3: Headers and Encoding

Wednesday, February 11, 2015 By Mike Schiffman

Farsight's Network Message, Volume 2: Introduction to nmsgtool

Wednesday, February 4, 2015 By Mike Schiffman

Farsight's Network Message, Volume 1: Introduction to NMSG

Wednesday, January 28, 2015 By Mike Schiffman

Data Retention In A Post-Breach World

Thursday, January 22, 2015 By Ben April

DNSDB API New Features

Wednesday, January 14, 2015 By Henry Stern

Using Passive DNS to Avoid Collateral Damage During Takedowns and Seizures

Wednesday, January 7, 2015 By Joe St Sauver, Ph.D.

Farsight's Advanced Exchange Access, part 3 of 3

Wednesday, December 17, 2014 By Mike Schiffman

Farsight's Advanced Exchange Access, part 2 of 3

Wednesday, December 10, 2014 By Mike Schiffman

Farsight's Advanced Exchange Access, part 1 of 3

Wednesday, December 3, 2014 By Mike Schiffman

Farsight

Wednesday, November 19, 2014 By Dr. Paul Vixie

Want to learn more?

Protect against cybercriminal activity in real-time.

Request a free demo