The storage section was useful, Josh. It’s easy to start collecting everything before deciding what you’ll actually need to query.
One way to keep the enrichment lighter is to save the CZDS changes locally, then pull DNS and WHOIS history for the domains worth investigating. I work on whoisfreaks.com, which has APIs for both. I’d keep the source and observation date alongside each result, so “first seen in our pipeline” stays separate from when the domain was registered.
The storage section was useful, Josh. It’s easy to start collecting everything before deciding what you’ll actually need to query.
One way to keep the enrichment lighter is to save the CZDS changes locally, then pull DNS and WHOIS history for the domains worth investigating. I work on whoisfreaks.com, which has APIs for both. I’d keep the source and observation date alongside each result, so “first seen in our pipeline” stays separate from when the domain was registered.