Patrick, It's Yet Another False Positive in anomaly detection and traffic analysis software that I fiddle with. In the case of CDNs, I mostly want to throw them out the window -- whenever I see one, I know that the reverse lookup information is going to be useless and it's time to toss that address out of the bucket and look at the next weird one on the list.
On Nov 16, 2013, at 5:28 PM, Patrick W. Gilmore <[email protected]> wrote: > First, the location of CDN nodes is not relevant to passive DNS monitoring. > If Andrew would like a list of domains with CDN hostnames in them, that might > be findable. > > Second, a list of CDN nodes is likely impossible to gather & maintain without > the help of the CDNs themselves. There are literally thousands of them, most > do not serve the entire Internet, and they change frequently. And before you > ask, I know at least Akamai will _not_ give you their list, so don't even try > to ask them. > > Sorry this makes your life more difficult. Perhaps if you explained why you > were doing address lookups, the collective body could help you come up with a > better solution? > > -- > TTFN, > patrick > > > On Nov 15, 2013, at 10:06 , Michael Collins, Aleae <[email protected]> wrote: > >> I'll second that; CDNs are a constant pain for me when I'm doing address >> lookups. A list of them would make life a lot easier for a bunch of >> different investigative processes. >> >> If there isn't one right now, I think I could get off my tuchas and >> start maintaining one if anyone's interested in pitching in. >> >> >> On 11/14/13 5:19 PM, Andrew Fried wrote: >>> Actually, a list of CDNs would be very handy. I harvest botnets and >>> fast flux hosts out of passive dns, and some of the heuristics used to >>> identify them are similar to what CDNs look like. >>> >>> Having a decent list of CDN effective top level domains alone would be >>> useful for redacting those hosts. >>> >>> Andy >>> >>> >>> Andrew Fried >>> [email protected] >>> >>> On 11/14/13, 5:11 PM, Patrick W. Gilmore wrote: >>>> List of CDNs would be difficult, but not impossible. Although they do >>>> different things, so a simple list is unlikely to be as useful as it >>>> looks. >>>> >>>> A lost of CDN "DC nodes" is not possible. Why do you care about such a >>>> thing anyway? >>>> >> >> >
