One of our goals is to provide data to "color your logs" (or "Augment" them, as vendors may say). I have been experimenting with various ways to get simplified access to "domain age" data for a while now. This means not just data about new domains but how old a particular domain is. It may be an interesting parameter to add to when investigating. To make it easier to retrieve this data, we now have two new API functions, and I may finally document them properly at https://isc.sans.edu/api (where you will find all the other random data we make available). I have been playing with this for a while and may have posted about it, but now it is as ready as it will be for a while. Lookups are simple:
Just replace "sans.org" with the domain you are interested in. For domains "first seen" on a particular date, try:
if you omit the date, the last date ("today") is returned. This only works for dates one month back. Quick FAQ:
--- |
Johannes 4509 Posts ISC Handler Jun 21st 2022 |
Reply Subscribe |
Jun 21st 2022 1 week ago |
I tried a few old domains (cisco,ibm, mit etc.) and the firstseen is always 2011-01-31.
It seems that is the earliest date for old domains or database was built then. Thanks, Rock |
Anonymous |
Reply Quote |
Jun 22nd 2022 6 days ago |
yes, old domains have this "artificial" first seen date. I started working on this last year and imported a list of old and popular domains and just set the first seen date to Jan 31st, 2011. A bit of a random date, but essentially just means: This domain is old enough where the exact registration date probably doesn't matter.
|
Johannes 4509 Posts ISC Handler |
Reply Quote |
Jun 22nd 2022 6 days ago |
Is this somehow related to domain_stats / domain_stats2 by Mark Beggett, with the ISC integration described here? https://github.com/MarkBaggett/domain_stats2
|
Anonymous |
Reply Quote |
Jun 22nd 2022 6 days ago |
that was the original motivation for this feature. But the complete integration as outlined in the GitHub readme is not ready yet.
|
Johannes 4509 Posts ISC Handler |
Reply Quote |
Jun 22nd 2022 6 days ago |
Sign Up for Free or Log In to start participating in the conversation!