RE: [gnso-ff-pdp-may08] I believe I've figured out a solution to the FF problem

["Greg Aaron" <gaaron@xxxxxxxxxxxx>]

Dear Marc:

You can query the nameservers in question and see what IP addresses come
back.  
Or, you can use the query tool that Joe posted.

Not scalable to large numbers, but sampling could help validate your idea.

All best,
--Greg

-----Original Message-----
From: owner-gnso-ff-pdp-may08@xxxxxxxxx
[mailto:owner-gnso-ff-pdp-may08@xxxxxxxxx] On Behalf Of Marc Perkel
Sent: Wednesday, September 17, 2008 10:47 AM
To: gaaron@xxxxxxxxxxxx
Cc: gnso-ff-pdp-may08@xxxxxxxxx
Subject: Re: [gnso-ff-pdp-may08] I believe I've figured out a solution to
the FF problem


If I could get the data I've suggested be made available then I would be 
able to do that.

Greg Aaron wrote:
> Efforts appreciated.  But it would be helpful if you can confirm whether
FF
> is even involved in these domains. 
>
>
> -----Original Message-----
> From: owner-gnso-ff-pdp-may08@xxxxxxxxx
> [mailto:owner-gnso-ff-pdp-may08@xxxxxxxxx] On Behalf Of Marc Perkel
> Sent: Wednesday, September 17, 2008 8:18 AM
> To: gnso-ff-pdp-may08@xxxxxxxxx
> Subject: [gnso-ff-pdp-may08] I believe I've figured out a solution to the
FF
> problem
>
>
> I'm managed indirectly to get a hold of (indirectly) the ZONE data for 
> several TLDs. Actually what I'm getting is a list of new zones added and 
> compiled in a way that the listings are domains under 5 days old. I'm 
> using this list to hunt for links within bot net spam that point to 
> these new domains. I'm now generating lists of domains that are 
> definitely used for spam and probably pointing to FF used for fraud. But 
> I don't yet have the information I need to detect FF.
>
> Even with what little data I have this is working. And it would have 0 
> impact on free speech. (Unless the free speech were being advertised 
> using botnet spam). I'm going to write a detailed explanation of how to 
> do it. This will be the link.
>
> http://wiki.junkemailfilter.com/index.php/Fast_Flux
>
> There's nothing there yet. But I'd appreciate it if this link could be 
> included in the report and labeled as an opinion of one of the group 
> members for further exploration.
>
> Thoughts?
>
>
>