Joe St Sauver

Featured in: Favicon

domaintools.com

Articles

Post Quantum Cryptography (PQC): You May Already Be Using It!

Oct 17, 2024 | domaintools.com | Eliza Kingsley |Joe St Sauver

While DNS makes the Internet approachable and usable for people, cryptography makes it secure. Without trustworthy encryption, logging on to remote computers, engaging in online banking and shopping, and exchanging confidential personal communications would be difficult, to say nothing of implications for national security-related systems. In this blog, we are going to stray from our DNS roots to talk about important changes happening in cryptography.
New Draft Rule on Ransomware Payments and Cyber Incident Reporting

May 16, 2024 | domaintools.com | Joe St Sauver

In 2022, Congress passed the “Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)“ see 6 USC 681 et. seq., Most provisions of that act have been on hold pending agency rulemaking. The Cybersecurity and Infrastructure Security Agency (CISA), a part of the Department of Homeland Security (DHS), published a mammoth filing in the Federal Register on 4/4/2024. The public has the opportunity to comment on that filing through June 3rd as many businesses will be impacted by this rule.
Enhancing dnsdbq Output With Geolocation Data

Mar 28, 2024 | domaintools.com | Fatima Saladis |Joe St Sauver

Farsight DNSDB allows users to query domain names and get back IP addresses. These DNS “A record” results link a domain name to one or more IP addresses for a time window. Often when doing an investigation, you may want additional contextual information about an IP Address, such as routing information via the IP’s Autonomous System Number (ASN) or even geolocation data related to that IP address.
Automatically Chasing CNAMEs in Farsight DNSDB Scout

Feb 22, 2024 | domaintools.com | Fatima Saladis |Joe St Sauver

There’s a new feature available in Farsight DNSDB Scout — the ability to automatically “chase” (or iteratively resolve) Canonical Name (CNAME) records in Farsight DNSDB with the goal being to get to an IP address. Identifying CNAMEs can provide another pivot point for investigators. If a threat actor uses infrastructure connected to CNAMEs, it tracks back to other domains or resolve to IP addresses. The ability to do this automatically means fewer steps for investigators.
Need A New PC? Buy One That's Prebuilt (Rather Than Building One Yourself)

Feb 1, 2024 | domaintools.com | Fatima Saladis |Joe St Sauver

In our earlier article (“TOWINAP, The Only Way Is Nuke and Pave“), we mentioned that sometimes you might be best off replacing an older-model computer once it becomes infected. When doing so, you could buy a new system pre-assembled, or you could try assembling one of your own.
Finding Patterns That Only Match Registered Domains (and Which Don't "Overmatch" Against Subdomains)

Jan 18, 2024 | domaintools.com | Fatima Saladis |Joe St Sauver

Sometimes you may want to match domains that have a particular string followed by a top-level domain (TLD), but run into problems with “overmatching,” such as finding subdomains buried deep in domains that also match your pattern of interest. In this article, we’ll show you how to use Farsight DNSDB to find such a set of domains quickly.
New Report Helps Users Bring Up a Secure Virtual Private Server Under Debian 11

Jan 11, 2024 | domaintools.com | Joe St Sauver

Self-managed Virtual Private Servers (VPS) have made new systems cheap for technically knowledgeable people to deploy, whether for hosting a personal (“vanity”) domain, to create a remote distributed node from which to collect data, for use in working with DNSDB API or the Security Information Exchange data, or for other purposes.
Finding New ASNs

Jan 4, 2024 | domaintools.com | Fatima Saladis |Joe St Sauver

A surprisingly large number of ASNs get assigned by the Internet’s regional registries every month, see table 1.
IPv6: You May Already Be Using It

Dec 14, 2023 | domaintools.com | Fatima Saladis |Joe St Sauver

The Internet has largely allocated all of the IPv4 addresses it has traditionally relied on, but because of clever work-arounds meant to “stretch” the currently available IPv4 address space, many people may not have been aware of that fact. Nonetheless, we all should be getting ready for the future of IPv6. Many people may already be using IPv6, they just may not know it.
New Improvements to dnsdbq

Nov 30, 2023 | domaintools.com | Fatima Saladis |Joe St Sauver

Casual passive DNS users often like Farsight DNSDB Scout for its easy-to-use point-and-click graphical user interface, whereas analysts working “at scale” often end up using dnsdbq, our command line interface client to DNSDB. dnsdbq is particularly convenient for big projects where you may be doing thousands or even hundreds of thousands of queries. For example, we recently mapped the entire Internet IPv4 address space via 16.7 million IPv4 /24 Rdata summary queries (link to the IPv4 report here).