Author Topic: Column Descriptions?  (Read 18331 times)

0 Members and 1 Guest are viewing this topic.

October 21, 2010, 06:34:45 pm
Read 18331 times

camda03

  • Newbie

  • Offline
  • *

  • 2

I'm working with the following list/file.


http://www.malwaredomainlist.com/mdlcsv.php

Just to make very sure I understand it correctly, does anyone have an "official" description of what each of the columns mean?

I've looked around, searched, and experimented (e.g. run forward and reverse dns lookups) with the data myself but I really need something better than the little bit I've found.

For example, in this ("randomly" selected, I just grabbed a line) example, how do adult-drive.com and 64.28.180.226 relate to each other?

 -   adult-drive.com   64.28.180.226   64-28-180-226-rev.cernel.net   Zlob   Andrew Frey / webmaster@hindleyscars.com   22945   1

If all I have to work with are IP addresses (no urls in my data, nothing I can do) can I reasonably do lookups on the ip addresses (e.g. 64.28.180.226) instead? 

Thanks!

October 22, 2010, 08:05:34 pm
Reply #1

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
-Date
adult-drive.comDomain
64.28.180.226IP Address
64-28-180-226-rev.cernel.netReverse Lookup
ZlobDescription
Andrew Frey / webmaster@hindleyscars.comRegistrant
22945ASN
1Inactive

You have choosen a bad example.  This url is inactive. Inactive means that either the domain doesn't exist any longer, the host is offline or has been cleaned.
The domain adult-drive.com doesn't exist any longer. It doesn't resolve to an ip address. Therefore you can't find a relation between domain name and ip address.
When the domain adult-drive.com was online, it resolved to ip address  64.28.180.226. Reverse lookup of ip address  64.28.180.226 was 64-28-180-226-rev.cernel.net.
Domain adult-drive.com was registered to "Andrew Frey / webmaster@hindleyscars.com". The threat at adult-drive.com was trojan Zlob.
ASN of ip address 64.28.180.226 is 22945. The first column contains the date when the url was added to datebase. If date is "-" then url is from 2007. At this time MDL didn't store date.

Ruining the bad guy's day

October 23, 2010, 07:49:47 pm
Reply #2

camda03

  • Newbie

  • Offline
  • *

  • 2
Great explanation!

Thanks!