Skip to content

[low] Add generate-parking-domain.py: reproducible import from the TMA 2022 parking artefact - #447

Closed
elhoim wants to merge 1 commit into
MISP:mainfrom
elhoim:auto-parking-domain
Closed

elhoim wants to merge 1 commit into
MISP:mainfrom
elhoim:auto-parking-domain

Conversation

@elhoim

@elhoim elhoim commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

BLUF

  • What: a generator for lists/parking-domain reading the A and AAAA indicators from the TMA 2022 parking artefact — the same source generate-parking-domain-ns.py uses for its NS indicators.
  • Provenance is measured, not assumed: 66 of the 67 addresses the paper publishes are already committed here. This list was built from that artefact by hand.
  • Effect today: 0 new entries. This PR makes the import reproducible; it does not claim to make the list more complete.
  • Priority: low. Reproducibility and provenance, not coverage.

The one address not added, and why

The artefact contains a single IPv6 /128 (2a05:d014:…/128, inside an AWS eu-central-1 allocation). That is the address a host happened to hold during the 2022 measurement, not an allocation held by a parking service, and it will have belonged to somebody else since. The generator skips individual IPv6 interface addresses as a rule and logs the decision.

The live source that was considered and rejected

Resolving the artefact's parking CNAME targets would give current addresses instead of 2022 ones. It is not done here, on inspection of the data: 20 of the 36 CNAME targets are AWS ELB, ALB or NLB names, whose addresses rotate between tenants. Because the generator unions and never removes, repeated runs would accumulate /32s that had since been reassigned to unrelated AWS customers — and a warninglist entry does not merely add noise, it suppresses. That failure is structural rather than something a filter fixes.

Honest limit

Same caveat as #442: a 2022 research artefact is not a live feed. It does not grow when a new parking service appears. A successful run means "the list matches the published evidence", not "the list is complete". No public feed of parking-service address space was found.

Implementation notes

  • Unions, never replaces. 42 committed addresses are not in the paper and are kept untouched.
  • Pattern indicators ({"ilike": …}) are skipped with a warning rather than expanded.
  • Refuses to write an empty list; verified idempotent; wired into generate_all.sh.

…A 2022 parking artefact

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@adulau

adulau commented Sep 4, 2026

Copy link
Copy Markdown
Member

This is 4 years old. Can you find a better source than https://github.com/tma22-parking/tma22-parking.github.io?

@elhoim

elhoim commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

You were right — the tma22 data was last touched 2022-07-04, and there is no maintained dataset to replace it (bambenek/parkingipaddresses is an empty repo from 2014).

So #449 drops the dataset approach entirely and measures instead: resolve a daily-updated newly-registered-domain feed, find addresses shared by many unrelated domains, and require positive evidence that each one serves parking (PTR or page title) before adding it. That found 5 current addresses none of the artefacts had — Loopia, Wedos and Domeneshop — while rejecting 53 popular-but-not-parking addresses (Vercel, Shopify, GitHub Pages, AWS Global Accelerator).

Closing this in favour of #449.

@elhoim
elhoim deleted the auto-parking-domain branch October 4, 2026 03:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants