New (And Newly - Changed) Fully Qualified Doman Names: A View of Worldwide Changes to DNS

on YouTube ↗58m

" summary

Farsight builds two real‑time feeds — a newly‑observed FQDN stream (roughly 150–300 new hostnames per second, about one new delegation per second or ~50,000/day) and a DNS changes stream (29 million changes in 24 hours; ~7M new RR names; extrapolated billions of FQDNs/year). Processing sits in RAM as a continuous in‑RAM processing pipeline that filters CDN noise and junk to surface phishing, DGA/fast‑flux activity, CNAME ad‑evasion and other actionable DNS events.

AI-written summary · about

" chapters (16)

1. 0:00Start
2. 2:17Everything Uses The Domain Name System (DNS)
3. 5:13Given Potentially Overwhelming Levels of DNS Traffic, You Need To Learn What You Can Ignore
4. 6:59What's The Security Information Exchange?
5. 12:28Short-Lived Cyber Criminal Domains vs. Comparatively Long-Lived Normal Domains Domains used by cyber criminal are "different:"
6. 14:34Blocklists and Cyber Criminal Domains
7. 17:03Newly Observed Hostnames Per Second and DNS Changes Volume Per Second
8. 21:45Newly Observed Domains (NOD)
9. 24:57Newly Observed Fully Qualified Domain Names
10. 30:13DNS Changes Channel
11. 36:14How Many DNS Changes In 24 Hours?
12. 36:40New Base Domains Seen In The 24 Hours of Data
13. 41:37CDNs and Location-Dependent Answers
14. 42:51Programmatic Name Generation
15. 45:41Domain Names Of Special Security Relevance
16. 46:43Black Hat Sound Bytes

" related talks

• 25mDark Side of the DNS ForceErik Wu · Black Hat USA 2016
• 01h 27mDNS at 30Jim Hague · ACCU 2017
• 15mYou Depend on DNS, This Is How It Works and You Won't...Philip Rowlands · SREcon23 Europe/Middle East/Africa
• 41mThe Secrets Behind Domain NamesThomas Fabre · Devoxx France 2023
• 29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...Kehuan Zhang, Zhou Li, Haixin Duan, Kun Du, Hao Yang · USENIX Security '16
• 27mA Longitudinal, End-to-End View of the DNSSEC EcosystemBalakrishnan Chandrasekaran, Bruce M. Maggs, Dave Levin, Taejoong Chung, Roland van Rijswijk-Deij, David R. Choffnes, Alan Mislove, Christo Wilson · 26th USENIX Security Symposium (USENIX Security '17)
• 26mMisuse of DNS, the Second Most Used ProtocolEmilio Couto · Black Hat Asia 2020
• 20mEverything about DNS you never dared to ask!Ole Michaelis · ElixirConf EU 2022