
Experimental Suspicious Domain Feed – SANS Internet Storm Center
We have had a “newly registered domain” feed for a few years. This feed pulls data from ICANN’s centralized zone data service (https://czds.icann.org) and TLS certificate transparency logs. The ICANN CZDS is a good start, but it only offers data from top-level domains collaborating with ICANN. Missing are in particular country-level domains. Country-level zone files…