I've worked in the industry at IID and Farsight. I am skeptical of many claims made by IoC vendors. You need timestamps, or first / last seen. Records don't e

I've worked in the industry at IID and Farsight. I am skeptical of many claims made by IoC vendors. You need timestamps, or first / last seen. Records don't exist in a vacuum. They come in RRsets. They are served (sometimes inconsistently) by different nameservers. Some use cases care about this. Records which don't resolve are also useful, especially for use cases which amount to front-running. On any given day if the wind was blowing the right direction .belkin could be one of the top 10 non-resolving TLDs. If your data is any good, check under .cisco for stuff which resolves to 127.0.53.53. ;-) Information about provenance (where the data comes from) is required for some use cases. We shipped Farsight's DNSDB on one or more 1TB drives, depending on what the customer was purchasing.