cyberresearch.us

TLP:CLEAR · #full-share #THOR Collective Dispatch

Open Season: CZDS

Josh Rickard / THOR Collective Dispatch

Summary

Josh Rickard frames ICANN CZDS daily gTLD zone files as an early-lifecycle hunting source: they show that a name was delegated and which authoritative name servers (plus glue IPs) serve it, often before CT issuance, hosting, or a live lure. Combined with CT, passive DNS, registrar context, and an existing intel feed, that delegation layer can surface reused NS infrastructure, fuzzy registrations, re-registration, and clusters. Defenders should care because it is one of the first durable artifacts in a typical phishing setup path.

Methods and tools

  • ICANN Centralized Zone Data Service (CZDS) daily zone files for participating gTLD registries
  • Zone mapping of delegated domains to authoritative name servers
  • Glue records (name-server IPs) when present
  • Time-based collection to observe NS reuse with fuzzy domains, domain re-use/re-registration, and outliers/clusters vs a threat-intelligence feed
  • Complementary sources named for later phases: Certificate Transparency logs, passive DNS, hosting/network intelligence, registrar ownership/registration data

Proposed lab recreation

These steps are a reading plan. They have not been run. Do not treat them as first-person lab work.

Proposed, not yet run.

  1. Request CZDS access and pull successive daily zone files for a limited set of participating gTLDs.
  2. Parse each file for delegated names, authoritative NS, and glue IPs; keep dated snapshots (not live resolution or site content).
  3. Diff day-over-day snapshots to list new delegations and names that drop then return (re-registration/reuse).
  4. Roll up by NS and glue IP to find servers that repeatedly sit next to lookalike or high-churn domains.
  5. Overlay those NS/domain clusters on an existing threat-intel list and, where available, CT issuance and passive-DNS timelines for the same names.
  6. Treat new delegations that share NS/glue with a known cluster as pre-campaign enrichment or hunt leads.

Lab notes

Not yet run. Add what you actually tried before claiming a recreation.

Source

This page is an attributed pointer plus hunting notes on Open Season: CZDS by Josh Rickard in THOR Collective Dispatch. It is not a reprint of the essay.

Read the original: https://dispatch.thorcollective.com/p/open-season-czds

Sources