1. Introduction
When searching DNSDB using the DNSDB API or DNSDB web interface, DNSDB allows you to search for domain names three different ways:
- Exact matches (
www.example.com), - Simple left-hand-side wildcard matches (
*.example.com), or - Simple right-hand-side wildcard matches (
www.example.*).
There are some other search queries that will NOT currently work. For example:
- You CAN’T search for a pattern that needs to have a wildcard on both the
left- and the right-hand sides simultaneously (
\*foobar\*), - You also CAN’T search for midstring wildcards (
foo\*bar), - Nor can you successfully do “partial-label” [1] searches (for example,
searching for
www.stsa\*will not matchwww.stsauver.comin DNSDB)
In some circumstances, such as when you’re searching for potentially infringing domain names, this can be potentially frustrating. What you’d really like is the ability to do arbitrary regular expression (regex) searches, just as you could with the Unix grep command.
Regrettably, you CAN’T currently do most grep-like searches if you’re using DNSDB API or the DNSDB web interface.
2. Well, What About Doing Regex Searches If I’m Using DNSDB EXPORT?
DNSDB Export normally works just like DNSDB API, except that a copy of the DNSDB database is run locally on the customer’s premises. Because DNSDB is running on a local customer server:
- Query latency can be dramatically reduced,
- The local site can have total control over server provisioning and operations,
- DNSDB can be used in totally offline environments, and
- Because queries and responses never leave the customer’s premises, query privacy is assured.
- Particularly relevant to today’s post, having a local copy of DNSDB’s MTBL database files expands the range of queries you can perform.
If you’re a DNSDB Export customer and would like to be able to run an expanded range of queries directly against the DNSDB MTBL) files you’ve downloaded, contact your Farsight account executive to discuss an amendment to your DNS Export contract that will protect your rights and ours. For the remainder of this article, we’ll assume you’ve already done so.
Let’s look at a practical example of what this new capability can mean.
3. Exploring Citibank(tm)-Related Domain Names
Citigroup is the fourth-largest bank in the United States. As such, it’s unsurprising that Citibank and its customers are often targeted for phishing attacks.
Many phishing attacks rely on domain names that embed a target’s brand in an effort to gain credibility while intentionally misleading users, thereby setting them up so they’re willing to disclose their username and password. Because this type of attack is so common, most cyber security teams pay close attention to new domain names that use their company’s service marks without authorization.
But how to find those potential infringing domains? DNSDB Export makes it easy.
For the purposes of this example, we’ll check one day’s MTBL files for any domains that contain the literal string “citibank”.
Naturally, there will likely be some legitimate citibank-related domains that include that literal, but we’re not concerned about those. What we’re concerned about is any “citibank” domains that are NOT under the control of Citibank.
Let’s check and see if we can find those in DNSDB MTBL files.
The first thing you need is access to the MTBL files. If you’ve licensed DNSDB Export, the MTBL files may be located right on the server you’re using, or, perhaps those files may be NFS mounted over the network, as ours are.
The MTBL file naming scheme is pretty self-descriptive for the most part:
- dns.* NON-DNSSEC records only
- dnssec.* DNSSEC records only
- YYYYMMDD[.HHMM] this is the date/UTC time that the data collection began
- m: this is a minutely file
- X: this is a decaminutely ("every ten minutes") file
- H: this is an hourly file
- D: this is a daily file
- M: this is a monthly file
- Y: this is a yearly file
For example, the MTBL daily files for February 5th, 2017 have names that look like:
$ cd /export/dnstable/mtbl $ ls -l dns*.20170205.D.mtbl -rw-r--r-- 1 root root 22,066,723,025 Feb 6 02:39 dns.20170205.D.mtbl -rw-r--r-- 1 root root 5,169,352,578 Feb 6 00:13 dnssec.20170205.D.mtbl [commas added for readability]
For the purposes of this article, we’re going to focus on just the roughly 22
gigabyte dns.20170205.D.mtbl file, and ignore the DNSSEC resource records
from that same date.
dns.20170205.D.mtbl is stored in MTBL binary format so we’ll need to
begin by decoding it into a more readily accessible format. We’ll do that with
the dnstable_dump command (which will normally be installed as part of your
DNSDB Export installation, however you can also review that code
here).
We can then pipe the output from dnstable_dump through grep.
To get a sense of how long it will take to dump that MTBL file and grep it, we’ve bracketed those commands with Unix “date” commands to show the starting and stopping timestamps:
$ date; dnstable_dump --rrset_names --json dns.20170205.D.mtbl | grep citibank > ~/citibank.txt ; date Mon Feb 6 22:04:26 UTC 2017 Mon Feb 6 22:07:45 UTC 2017
As you can see from the reported timestamps, that process took only a few minutes, even when dumping and brute force grep’ing 22 gigabytes of data from an NFS-mounted disk on a relatively-low-powered blade server.
Going to the directory where the output from that search was written, we can see that our search found 1290 “hits” that contained the literal string “citibank”:
$ wc -l citibank.txt 1290 citibank.txt
The first 20 lines of that output file looks like:
$ head -20 citibank.txt
{"rrset_name":"a.mx.emailmessage2.citibank.com."}
{"rrset_name":"a.mx.serviceemail2.citibank.com."}
{"rrset_name":"a.ns.email.citibank.co.uk."}
{"rrset_name":"a.ns.emailmessage2.citibank.com."}
{"rrset_name":"a.ns.serviceemail2.citibank.com."}
{"rrset_name":"b.mx.serviceemail2.citibank.com."}
{"rrset_name":"b.ns.email.citibank.co.uk."}
{"rrset_name":"b.ns.emailmessage2.citibank.com."}
{"rrset_name":"b.ns.serviceemail2.citibank.com."}
{"rrset_name":"c.ns.email.citibank.co.uk."}
{"rrset_name":"c.ns.emailmessage2.citibank.com."}
{"rrset_name":"c.ns.serviceemail2.citibank.com."}
{"rrset_name":"d.ns.email.citibank.co.uk."}
{"rrset_name":"d.ns.emailmessage2.citibank.com."}
{"rrset_name":"d.ns.serviceemail2.citibank.com."}
{"rrset_name":"e.ns.email.citibank.co.uk."}
{"rrset_name":"e.ns.emailmessage2.citibank.com."}
{"rrset_name":"e.ns.serviceemail2.citibank.com."}
{"rrset_name":"f.ns.email.citibank.co.uk."}
{"rrset_name":"f.ns.emailmessage2.citibank.com."}
[etc]
You’ll notice that those records are in “JSON Lines” (newline-delimited JSON) format. We can further process those records with jq so that we’re left with just the domain names themselves; we’ll then use the reverse-domain-names script [2] and the Unix sort command to prepare those domains for analyst review:
$ jq -r .rrset_name < citibank.txt | reverse-domain-names | sort -u > citibank2.txt
The 1290 matching domains (in reversed format) can be seen in Appendix I.
PLEASE NOTE: we strongly recommend AGAINST casually visiting any potentially-infringing domain since, while some are legitimate, other domains may attempt to drop malware on anyone who visits them. Let’s be careful out there!
4. Sorting the “Sheep” From the “Goats” With Domain Whois
Normally, a brand owner will have a list of the domain names that are part of their domain name portfolio. Comparing that list against the list you’ve found in DNSDB can easily be done with grep -v or with brief Perl code such as the “weedout” script below [3].
However, in our case, we don’t have access to Citibank’s own list of domains, so we’ll need to improvise a little.
There are many approaches you could try, but just to show one approach, let’s try DomainTool’s nifty Bulk Parsed Whois tool, a very popular for-fee Whois service.
We’ll prepare our list of effective-2nd-level domains [4] that need checking by saying:
$ jq -r .rrset_name < citibank.txt | 2nd-level-dom | sort -u > citibank3.txt $ wc -l citibank3.txt 716 citibank3.txt
716 effective-2nd-level domains to check is a perfect number of domains to work with given that the DomainTools Bulk Parsed Whois tool can work with up to 2,000 entries per submission.
To check the 716 domains we found with DNSDB Export, we copy and paste that list of domains into the DomainTools web form. See Figure 1.
Figure 1.
After we copy and paste in our domains and submit that form, DomainTools will return a CSV file with our results.
Opening that file with Microsoft Excel, sorting by column D (the administrative contact organization), and shrinking columns B and C which we don’t particularly need right now, we can see some of the domains that are listed as having a CitiBank N.A. administative contact. See the excerpt from the CSV file in Figure 2.
Figure 2.
This simple step allows us to stop worrying about at least 320 of the 716 effective 2nd-level domains we’ve found. Many others may be able to be eliminated by simple inspection. For example, citibankaaadvantagemiles.com appears to be a co-branded payment card offered in conjunction with American Airlines, Inc. That’s hardly a domain that should make a fraud analyst’s eyebrow go up.
Having eliminated the domains that belong directly to Citibank, and the domains that are in use by legitimate partners (such as American Airlines), the security analyst can then do a deep dive on the remaining effective-2nd-level domains that may still be of unknown provenance.
5. Real-Time Brand Protection
If you’re interested in brand protection, but you need something automated that works in real-time, Farsight also has this use case covered. By leveraging our Brand Sentry product, an organization can monitor in real-time its brands for unauthorized or uncharacteristic usage. To learn more about Brand Sentry, please contact Farsight Security, Inc., sales at https://www.farsightsecurity.com/order-services/.
6. Conclusion
We’ve seen how searching for a simple midstring wildcard (like “citibank”) in MTBL files can open up productive new areas for brand protection investigators. However, in looking at that example, we’ve barely scratched the surface. Imagine searching DNSDB for any sort of regular expression you could write in grep!
What arbitrary matching expressions will you try against your on-premises DNSDB Export database?
If you need information about how to license DNSDB Export for your company, please contact Farsight Security, Inc., sales at https://www.farsightsecurity.com/order-services/.
Notes:
[1] A label can be thought of as a “chunk” of a domain name as delimited by dots. For instance, www.example.com has three labels: www, example, and com.
[2] reverse-domain-names is just a simple perl script:
#!/usr/bin/perl
my @lines = <>;
chomp @lines;
@lines =
map { join ".", reverse split /\./ }
sort
@lines;
print "$_\n" for @lines;
[3] The little Perl weedout script is pretty simple, too:
#!/usr/bin/perl
while (<>) {
$weed{$_}=1;
}
while (<>) {
print unless $weed{$_};
}
[4] For background on effective 2nd-level-domains, please check out The Public Suffix List.
If you want a copy of the 2nd-level-dom script, it looks like:
#!/usr/bin/perl
use strict;
use warnings;
use IO::Socket::SSL::PublicSuffix;
my $pslfile = '/your\_path\_here/public\_suffix\_list.dat';
my $ps = IO::Socket::SSL::PublicSuffix->from\_file($pslfile);
my $line;
foreach $line (<>) {
chomp($line);
my $root_domain = $ps->public_suffix($line,1);
printf( "%s\n", $root_domain );
}
Appendix I. “citibank” domains (in reversed format)
NOTE: Potentially Malicious Domains! While some of these domains are legitimate domains, others may attempt to phish you or drop malware on you if you visit them. Because of this risk, please do NOT visit any listed domain unless you know those domains are safe, or you’re a trained professional cyber security analyst and you’ve taken appropriate precautions.
adult.citibank ae.citibank ae.citibank.alertingservicesuat ae.citibank.clay ae.citibank.mart ae.citibank.mobile ae.citibank.online ae.citibank.tram ae.citibank.www ar.com.citibank ar.com.citibank.empresas ar.com.citibank.www asia.citibank au.com.citibank au.com.citibank.bulb au.com.citibank.chat au.com.citibankdining au.com.citibankdining.www au.com.citibank.email au.com.citibank.email.image au.com.citibank.lendersystemuat au.com.citibank.mobile au.com.citibank.mortgagebroker.uat au.com.citibank.pat.mobile au.com.citibank.plant au.com.citibank.strings au.com.citibank.www au.com.citibank.www2 au.com.citigroup.wlb.au.citibank au.com.thepositivityproject.dhqapdeqiz.com.citibank.online au.com.thepositivityproject.ot8sbd1gw2.com.citibank.online be.citibank be.citibank.citibankonline be.citibank.www bet.citibank bg.citibank bh.com.citibank bh.com.citibank.alternate bh.com.citibank.chat bh.com.citibank.production bh.com.citibank.production.www bh.com.citibank.www bid.citibankcard biz.citibanking biz.citibankonline biz.citibanksa biz.citibankwings black.citibank blog.citibank blue.citibank br.b.citibank br.b.citibank.www br.com.bancocitibank br.com.citibank br.com.citibank.ajuda br.com.citibankblack br.com.citibankblackcard br.com.citibankcards br.com.citibank.cardsonline br.com.citibank.cardsonline.www br.com.citibank.chat br.com.citibankcuentatransfer br.com.citibankhall br.com.citibank.privilegio br.com.citibankseguros br.com.citibanktitaniumcard br.com.citibanktransfer br.com.citibank.troco br.com.citibank.www br.com.cuentatransfercitibank br.com.hktreina.qmtfm.com.citibank.online br.com.prestum.citibank br.net.ahera.citibank.www broker.citibank buzz.citibank ca.citibank ca.citibank.www cat.citibank center.citibank ceo.citibank ch.citibank click.citibank cloud.citibank cloud.citibanks cl.sindicatocitibank cl.sindicatocitibank.www club.citibank cm.citibank cn.citibank cn.citibank.www cn.com.citibank cn.com.citibank.chair cn.com.citibank.grand cn.com.citibank.mobile cn.com.citibank.slice cn.com.citibank.uat1.globalcommonbuild cn.com.citibank.uat2.globalcommon.cnmobile cn.com.citibank.www cn.zj.citibank co.citibank co.com.citibank co.com.citibank.fila co.com.citibank.m co.com.citibank.puente co.com.citibank.solapa co.com.citibank.www com.2dayshippingbycitibank com.aacitibank com.accountupdate-citibank com.acitibank com.advancecashvacation.card.travel.government.citibank.www com.agari.rua._dmarc._report.com.citibank com.anticitibank com.apaccitibank com.appstudios.tmhwm8ocht.com.citibank.online com.argentinacitibank com.bancocitibank com.banklocationmaps.citibank com.betomultimarcas.my.com.citibank.www com.brasil-citibankbr com.career.citibank com.cariyuk.ayamtulanglunakhayamwuruk.www.atmcitibank.furnitureworkshopwangi com.cariyuk.cake.sugarandegg.atmcitibank.ristra com.cariyuk.com.cetakdong.jerseybola.citibank com.cariyuk.hongtang.www.atmcitibank.ristra com.cariyuk.hongtang.www.citibank.ambienteitalianrestaurant com.cariyuk.hongtang.www.citibank.americangrill com.cariyuk.hongtang.www.citibank.brigitafastfood com.cariyuk.hongtang.www.citibank.nyx com.cariyuk.hongtang.www.wacoal.atmcitibank com.cariyuk.yoshinoya.pokesushi.atmcitibank.daisho com.cariyuk.yoshinoya.pokesushi.atmcitibank.gaudi com.cariyuk.yoshinoya.pokesushi.atmcitibank.osella com.cashedge.ft.citibankui com.ccitibank com.citibank com.citibank1 com.citibank666 com.citibankaa com.citibankaaadvantagemiles com.citibankaadvantage com.citibankaa.ww2 com.citibankaccount com.citibankaccountonline com.citibank.accountonline com.citibank.accountonline.www com.citibankadvantage com.citibankaffiliate com.citibankalbania com.citibankalum com.citibankaol com.citibank.apac.chat com.citibank.apac.secureauthentication com.citibank.apac.verifysecureenrollment com.citibank.ap.connecttr1 com.citibankarena com.citibankargentina com.citibank.argentina.campo com.citibank.argentina.chat com.citibank.argentina.red com.citibank.argentina.stocks com.citibank.argentina.tarjeta com.citibank.argentina.www com.citibank.asia.www com.citibankatwork com.citibankatwork.www com.citibankauto com.citibankautofinance com.citibankautofinanee com.citibankautoloan com.citibankautoloans com.citibankauto.ww12 com.citibankbahrain com.citibankbanamex com.citibankbanamexusa com.citibank-banamexusa com.citibankbanamexusa.www com.citibankbangladesh com.citibankbank com.citibank.banking com.citibankbanksters com.citibankbank.ww1 com.citibankbelgium com.citibankberhad com.citibankbillmanager com.citibankbitcoin com.citibankblack com.citibankblackcard com.citibank.brasil.www com.citibankbrazil com.citibank.brazil.corporate com.citibank-brgcb com.citibankbroker com.citibankbrokerage com.citibankbulgaria com.citibankbusiness com.citibank.businessaccess com.citibankbusinesscard com.citibankbusinessonline com.citibankbusinessonline.www com.citibankc com.citibank.calculators com.citibank.campus.www com.citibankcanada com.citibankcard com.citibank-card com.citibankcards com.citibankcardservices com.citibankcards.info com.citibankcards.mail com.citibankcards.www com.citibankcard.www com.citibankcareer com.citibankcareers com.citibank.careers com.citibank.careers.www com.citibankcashreturn com.citibankcashreturncard com.citibankcashreturns com.citibankcashreturnscard com.citibankcd com.citibankcds com.citibank.ceemea.www com.citibankcentertickets com.citibankcerditcard com.citibankchecking com.citibankcheckingaccount com.citibankchecks com.citibankchile com.citibankchina com.citibank.citiconnecteu com.citibank.citidirectonline.www com.citibank.citigold.argentina.www com.citibank.citirewards com.citibankclassaction com.citibankcloud com.citibank.cobrosonline.www com.citibankcolombia com.citibank.columbia.www com.citibankcom com.citibank-com com.citibankcom.ww25 com.citibankcrdeitcard com.citibankcredicard com.citibank-credicard com.citibankcredit com.citibankcreditcard com.citibankcreditcardmastertrust com.citibankcreditcardonline com.citibankcreditcards com.citibankcreditcards.www com.citibankcreditmonitoring com.citibankcreditmonitoringservice com.citibankcreditmonitoring.ww4 com.citibankcreditreport com.citibankcredits com.citibankcreitcard com.citibankcuentatransfer com.citibankcustomer com.citibankcustomerservice com.citibankd com.citibank.daqa-us.olb-armtu1web1 com.citibank.daqa-us.olb-armtu1web1-cg com.citibank.da-us.citibusinessonline com.citibank.da-us.olb-usmtprweb3 com.citibank.da-us.web com.citibank.da-us.web-ao com.citibankdebt com.citibankdenmark com.citibank.dev2.citiwallet com.citibank.dev.citiwallet com.citibankdiamond com.citibankdining com.citibank.dir com.citibankdirect com.citibank.direct com.citibankdirectaccess com.citibankdiversity com.citibankdividend com.citibank._dmarc com.citibank._domainkey._adsp com.citibank._domainkey.maila com.citibankdubai com.citibankeasydeals com.citibankeasydeals.ww25 com.citibankebilling com.citibank-ebilling com.citibank-e-business com.citibankegypt com.citibankegypt.production com.citibankegypt.www com.citibank.emailmessage2 com.citibank.emailmessage2.l com.citibank.emailmessage2.mx.a com.citibank.emailmessage2.ns.a com.citibank.emailmessage2.ns.b com.citibank.emailmessage2.ns.c com.citibank.emailmessage2.ns.d com.citibank.emailmessage2.ns.e com.citibank.emailmessage2.ns.f com.citibank.emailmessage2.x com.citibankemployment com.citibank-entertainer com.citibankequity com.citibankesavings com.citibank-escucha com.citibankespanol com.citibank.feedback com.citibankfinance com.citibankfinancial com.citibankfinancialservices com.citibankfinland com.citibankforeigncurrency com.citibankforeignexchange com.citibankfrance com.citibankfreeshipping com.citibankfsb com.citibankfundtransfer com.citibankfx com.citibankfxlink com.citibankgermany com.citibank.globalcommonbuild.thgcb.uat1 com.citibankgold com.citibankgoldcard com.citibankgold.ww12 com.citibankgreece com.citibankgroup com.citibankgroups com.citibankgroupsplc com.citibankgroups.www com.citibankguam com.citibankguide com.citibankhandlowy com.citibankhelp com.citibankhilton com.citibankhiltoncard com.citibankhiltonhhonors com.citibankhiltonhonors com.citibankhomeequity com.citibankhomeequityloan com.citibankhongkong com.citibankhotel com.citibank.hsa.secure com.citibankhungary com.citibanki com.citibank-icard com.citibankindia com.citibank.india.remoteaccesstest.marketuat com.citibank.india.remoteaccesstest.www com.citibankindia.www com.citibankindonesia com.citibank.info com.citibank.info3 com.citibank.info3._domainkey.default com.citibank.info9 com.citibank.info9.click com.citibank.info9.image com.citibank.info9.view com.citibank.info._dmarc com.citibank.info._domainkey.ei com.citibank.info.mail2 com.citibanking com.citibankingcareers com.citibankingonline com.citibankinsurance com.citibankinterestrates com.citibank.interinstitutiontransfers com.citibankinternational com.citibankinternetbanking com.citibankintl com.citibankinvestments com.citibankiran com.citibankiraq com.citibankireland com.citibankitaly com.citibanki.www com.citibankj com.citibankjamaica com.citibankjapan com.citibankjobs com.citibankjobs.ww38 com.citibankjordan com.citibankk com.citibankkenya com.citibankkonline com.citibankkorea com.citibankkuwait com.citibankl com.citibank.latam.www com.citibank.latinamerica.www com.citibanklending com.citibank-listens-my com.citibankloan com.citibankloanhelp com.citibankloans com.citibanklocation com.citibank.locations com.citibanklocation.www com.citibanklogin com.citibanklogin.ww2 com.citibanklogin.www com.citibanklondon com.citibank-london com.citibankmagazines com.citibank-maghreb com.citibankmalaysia com.citibankmaldives com.citibankmastercard com.citibank-mead-alumni com.citibankmerchantservices com.citibank.metrics com.citibank.metrics1 com.citibankmobile com.citibank.mobile.sit04 com.citibank.mobile.sit10 com.citibank.mobile.uat01 com.citibank.mobile.uat04 com.citibank.mobile.uat05 com.citibank.mobile.uat09 com.citibankmongolia com.citibankmonitoring com.citibankmonitoringservice com.citibank-morocco com.citibankmortage com.citibankmortage.ww11 com.citibankmortgage com.citibankmortgagerate com.citibankmtg com.citibankna com.citibanknepal com.citibank.netbanking com.citibanknetherlands com.citibanknetnews com.citibank-newyork com.citibanknewzealand com.citibanknigeria com.citibanknline com.citibanknorge com.citibanknorway com.citibanknri com.citibank.ns com.citibank.ns2 com.citibank.ns5 com.citibankny com.citibanko com.citibank.oak1 com.citibankoffer com.citibank.offer com.citibank.offer.www com.citibankoffice com.citibankoinline com.citibankoline com.citibankoman com.citibankomline com.citibankon com.citibankoneline com.citibankonie com.citibankonilne com.citibankonine com.citibankonine.ww38 com.citibankonli com.citibankonlie com.citibankonlien com.citibankonlie.ww1 com.citibankonlime com.citibankonlin com.citibankonline com.citibank-online com.citibank.online com.citibankon-line com.citibankonlinebanking com.citibankonline.citimobile com.citibankonline.citiretailservices com.citibankonline.citiretailservicesmobile com.citibankonline.citiwallet com.citibankonline.citiwallet2 com.citibankonlinecom com.citibank.online.content22 com.citibankonline.digital.folder com.citibankonline.digitalmarketing com.citibankonline.digitalmarketing.cdn com.citibankonline.future.frame com.citibankonline.general.window com.citibankonline.globalmobilelatam com.citibankonline.lusgtdc-egsl05 com.citibankonline.lusswdc-egsl05 com.citibankonline.mobile com.citibankonline.mobilelatam com.citibankonline.mobile-prev com.citibankonlineqa com.citibankonlineqa.olb-usmtu2web1 com.citibankonlineqa.uat1.banamex.portal com.citibankonlineqa.uat1.colombiapayment com.citibankonlineqa.uat1.colombiapayment.validar com.citibankonlineqa.uat2.colombiapayment com.citibankonlineqa.uat2.elsalvador com.citibankonlineqa.uatpaper com.citibankonlineqa.web.productest9 com.citibankonlines com.citibankonlineservice com.citibankonlines.ww38 com.citibankonline.tablet com.citibankonline.www com.citibankonlinne com.citibankonlinr com.citibankonli.ww25 com.citibankonlline com.citibankonlne com.citibankonlne.ww25 com.citibankonlone com.citibankonlone.ww25 com.citibankorg com.citibankpakistan com.citibankpanama com.citibankpanama.ww7 com.citibank.paper com.citibankpaylink com.citibankpayment com.citibankpayments com.citibankpb com.citibankpb.www com.citibankpensions com.citibankpersonalloans com.citibankperu com.citibankplace com.citibankplatinum com.citibankplatinumcard com.citibankplatinummastercard com.citibankplatinumselect com.citibankplaza com.citibankplaza.www com.citibankplc com.citibankplus com.citibankplus.www com.citibankpoland com.citibankpr com.citibankpreferredcard com.citibankprepaid com.citibank-private com.citibankprivatebank com.citibank.privatebank.americas.citiprivatebankinview com.citibank.privatebank.americas.websocket com.citibank.privatebank.citiprivatebankinview com.citibank.privatebank.emea.citiprivatebankinview com.citibank.privatebank.mobile2 com.citibank.privatebank.www com.citibank.privatebank.www2 com.citibank.privatebank.www5 com.citibank.privatebank.wwwqa com.citibank.privateclient.citigold.www2 com.citibankprivatestudentloanconsolidation com.citibankprivileges com.citibankproducts com.citibankprofessional com.citibankprofessionalcard com.citibank.qa.citiwallet com.citibankr com.citibankrates com.citibank.remoteaccountfulfillment com.citibankreo com.citibankreversemortgage com.citibankreversemortgages com.citibankreview com.citibankreward com.citibankrewardcard com.citibankrewardscard com.citibankro com.citibankromania com.citibankroutingnumber com.citibankroutingnumber.ww17 com.citibankrussia com.citibanks com.citibanksa com.citibanksaudiarabia com.citibanksavings com.citibankscard com.citibankscreditcard com.citibanksearch com.citibank.securities com.citibankseguros com.citibankselect com.citibankservice com.citibank.serviceemail1 com.citibank.serviceemail2 com.citibank.serviceemail2.i com.citibank.serviceemail2.l com.citibank.serviceemail2.mx.a com.citibank.serviceemail2.mx.b com.citibank.serviceemail2.ns.a com.citibank.serviceemail2.ns.b com.citibank.serviceemail2.ns.c com.citibank.serviceemail2.ns.d com.citibank.serviceemail2.ns.e com.citibank.serviceemail2.ns.f com.citibank.serviceemail2.p1-182245 com.citibank.serviceemail2.p1-204144 com.citibank.serviceemail2.x com.citibank.servicemail com.citibank.servicemail._domainkey.sm1024 com.citibanksharedealing com.citibankshares com.citibankshortsale com.citibanksingapore com.citibank.sit2.mobile com.citibank.sit.citiretailservices com.citibanksites com.citibank-slucha com.citibanksouthafrica com.citibankspain com.citibanksrilanka com.citibank.step com.citibankstockmarket com.citibankstudent com.citibankstudentloan com.citibank.studentloan com.citibankstudentloans com.citibankstudentloans.ww2 com.citibankstudentlons com.citibanksucks com.citibanksupport com.citibanksustainability com.citibanksverige com.citibanksweden com.citibankswitzerland com.citibanks.www com.citibanktaiwan com.citibanktarjetas com.citibankthailand com.citibankthankyou com.citibank.thankyou com.citibank.thankyou._domainkey.ei com.citibankthankyourewards com.citibanktitanium com.citibanktitaniumcard com.citibanktoday com.citibanktoolbar com.citibank.tracking com.citibanktransfer com.citibanktravel com.citibanktrust com.citibankturkey com.citibankturkiye com.citibankuae com.citibankuae.ww2 com.citibank.uat.citiretailservices com.citibankuk com.citibankukraine com.citibankupromise com.citibank-us com.citibankusa com.citibankusacards com.citibankusana com.citibankusa.ns com.citibankusa.ns2 com.citibank-us.www com.citibank.vendorweb com.citibankvenezuela com.citibankvisa com.citibank-visa com.citibankvisacard com.citibankvisa.ww1 com.citibank-visa.www com.citibankvisa.www com.citibankwarrant com.citibankwarrants com.citibank.wealthmanagement.research com.citibankwealthmanager com.citibank.webcashmanagercitibusiness com.citibankwebsite com.citibankwings com.citibankwomen com.citibank.worldprivileges.www com.citibankworldwide com.citibank.www com.citibank.www1 com.citibank.www2 com.citibank.www3 com.citibankz com.citibankzimbabwe com.citicitibank com.citicitibank.ww25 com.citi._dmarc._report.com.citibank com.citigroup.citibank.businessaccess com.citigroup.citibank.images com.citigroup.citibank.www2 com.comcitibank com.costcocitibankvisa com.credicard-citibank com.digicitibank com.dns286.com.citibankproducts com.dns286.us.citibankcuentatransfer com.dogmastudios.oqcdxy0khf.com.citibank.online com.ebilling.citibankcanada com.eprize.promo.citibank com.fiserv.saml-citibankonline com.goldcardcitibank com.goldcardcitibank.www com.googlecitibank com.googlecitibank.www com.gotocitibank com.gotocitibank.www com.gotoip11.citibank1812 com.havanacitibank com.havanacitibank.www com.hitbox.ehg-citibank com.hitbox.ehg-citibank1p com.hk.citibank com.homecitibank com.homecitibank.www com.hypestat.com.citibank com.iapps4you.citibank-au com.iapps4you.citibank-romania com.iconic-mgmt.citibank-perfect-1.www com.indir.citibank-in com.ispycitibank com.ispycitibank.www com.jqjxq.us.com.citibank.online com.kweedo.lxf0f4zh4m.com.citibank.online com.kweedo.wh9pfdmgf1.com.citibank.online com.leadcitibank com.leadfusion.tools.citibank com.limchristinecitibankhongkong com.livejournal.citibank com.mail-citibank com.mcitibank com.measuredup.citibank-reviews com.menaracitibank com.micitibank com.mycitibank com.my-citibank com.mycitibankdirect com.mycitibankexperience com.mycitibankjobs com.mycitibankonline com.mycitibankonline.www com.mycitibank.www com.myxangatoolbar.citibankhandlowy com.ncitibank com.netbankingcitibank com.newyorkcitibank com.nfccitibank com.ngan-hang.citibank com.nycitibank com.ny-citibank com.occupycitibank com.offercitibank com.onlinebanking-citibank com.onlinebankingcitibanktr com.onlinecitibank com.onlinecitibankgroup com.onlinecitibank.www company.citibank com.pfsour.citibank com.pissedconsumer.citibank com.placestars.citibank-5 com.placestars.citibank-n-a-miami-fl-us-1 com.placestars.citibank-pasadena-ca-us-1 com.placestars.citibank-san-mateo-ca-us com.placestars.citibank-watermael-sprl-fb-finances com.placestars.citibank-west-fsb-tujunga-ca com.portalcitibankbr com.portal-citibankservicosbr com.private-citibank com.processandocitibank com.processandocitibank.www com.purecitibank com.smartmobilemenus.jczgf0wlma.com.citibank.online com.thecitibank com.tmpseoqa.citibankredesign com.tpimidia.boletocitibank com.tpimidia.mail.pme1.citibank com.tumblr.citibankcom com.updateverification.citibank com.uptodown.en.citibank-es com.vnfiba.citibank com.warrantcitibank com.wilink.ar.citibank com.wwwcitibank com.wwwcitibankvisa com.zip-codez.citibank consulting.citibank cr.co.citibank cr.co.citibank.www cz.citibank cz.citibankatwork cz.citibank.denim cz.citibank.mobile.www cz.citibank-online cz.citibank.production cz.citibank.www cz.jobs.citibank de.citibank de.citibank.multilink de.citibank.www de.planetapes.citibank design.citibank do.com.citibank do.com.citibank.www email.citibank enterprises.citibank es.citibank es.citibank.production es.citibank.www es.com.citibank es.com.mycitibankblackcard es.com.mycitibanktitaniumcard es.mycitibankblackcard es.mycitibanktitaniumcard es.wwwcitibank eu.citi.ipb.citibankonline fans.citibank forex.citibank fr.citibank fr.citibank.www ga.citibankhorror gift.citibank gr.citibank gr.citibank.www gt.com.citibank gt.com.citibank.www gu.com.citibank gu.com.citibank.www guru.easylink.com-update-account-verification-2017-security-steps-for-1.citibank.online help.citibank hk.citibank hk.com.citibank hk.com.citibank.bottle hk.com.citibank.cold hk.com.citibank.mobile hk.com.citibank.step hk.com.citibank.www hk.com.myforum.citibank hn.com.citibank hn.com.citibank.www ht.com.citibank hu.citibank hu.citibank.mobile hu.citibank.www id.co.citibank id.co.citibank.chat id.co.citibank.mart id.co.citibank.mobile id.co.citibank.pile id.co.citibank.west id.co.citibank.www id.co.citibank.www.cob ie.citibank il.co.citibank immobilien.citibank in.citibank in.citibankmail in.citibankshopperstopcobrandcard in.co.citibank in.co.citibank.chat in.co.citibank.gcb.consumerservices in.co.citibank.gcb.market in.co.citibank.gcb.retailservices in.co.citibankk in.co.citibank.m in.co.citibank.mobile in.co.citibankonline in.co.citibank.online in.co.citibank.online.www in.co.citibankshoppersstopcard in.co.citibankshopperstopcobrandcard in.co.citibank.test.www in.co.citibank.www in.co.firstcitizencitibankcobrandcard in.co.firstcitizencitibankcobrandcreditcard in.co.firstcitizencitibankcobrandedcard in.co.firstcitizencitibankcreditcard in.co.firstcitizencitibanktitaniumcreditcard in.co.onlinecitibank in.co.onlinecitibank.www in.co.shoppersstopcitibankcard in.co.shoppersstopcitibankcobrandcard in.co.wwwcitibank in.creditcardstatus.citibank in.firstcitizencitibankcobrandcard in.firstcitizencitibankcobrandcreditcard in.firstcitizencitibankcreditcard in.firstcitizencitibanktitaniumcreditcard info.1-18002payday.payday-loans-with-debit-card-direct-deposit-advance-citibank info.citibankonline ink.citibank in.shoppersstopcitibankcobrandcard in.shoppersstopcitibankcobrandedcard in.wwwcitibank it.citibank it.wwwcitibank jobs.citibank jp.co.citibank jp.co.citibank.citicardsonline jp.co.citibank.www kr.co.citibank kr.co.citibank.accesscontrol kr.co.citibank.homeuat kr.co.citibank.image kr.co.citibank-loan kr.co.citibank-loan.www kr.co.citibank.mobile kr.co.citibank.open kr.co.citibank.www kz.citibank kz.citibank.www kz.com.citibank lgbt.citibank live.citibank loan.citibank lol.citibank love.citibank lu.citibank management.citibank market.citibank markets.citibank melbourne.citibank men.citibank miami.citibank ml.citibank-ru mom.citibank moscow.citibank my.citibank my.com.citibank my.com.citibank.billpaymentuat my.com.citibank.chat my.com.citibank.images my.com.citibank.mobile my.com.citibank.paymentgateway my.com.citibank.ring my.com.citibank.spade my.com.citibank.www net.1fr1.db-citibank net.adeptra.citibank.cmcld net.adeptra.citibank.crpluscse net.adeptra.citibank.cusccfrm net.adeptra.citibank.cusfcffew net.adeptra.citibank.cusfdmp net.adeptra.citibank.cusfrcfrm net.adeptra.citibank.cusfrmrpl net.adeptra.citibank.cusmcli net.adeptra.citibank.cusmon net.adeptra.citibank.cusscsn net.akadns.citibank-ru.www-weighted-ru net.akadns.com.citibank.dal-online net.akadns.globalredir.net.edgekey.cn.com.citibank net.akadns.globalredir.net.edgekey.cn.com.citibank.mobile net.akadns.globalredir.net.edgekey.cn.com.citibank.uat1.globalcommonbuild net.akadns.globalredir.net.edgekey.cn.com.citibank.uat2.globalcommon.cnmobile net.cdnga.com.citibank.serviceemail2.i net.citibank net.citibankbrasil net.citibanksignon net.citibankstudentloans net.edgekey.ae.citibank.mobile net.edgekey.ae.citibank.online net.edgekey.au.com.citibankdining.www net.edgekey.br.com.citibank.www.san net.edgekey.cn.com.citibank net.edgekey.cn.com.citibank.mobile net.edgekey.cn.com.citibank.uat1.globalcommonbuild net.edgekey.cn.com.citibank.uat2.globalcommon.cnmobile net.edgekey.co.com.citibank.www.san net.edgekey.com.citibank.argentina.uat.san net.edgekey.com.citibank.argentina.www.san net.edgekey.com.citibank.mobile.sit08.san net.edgekey.com.citibank.mobile.uat04.san net.edgekey.com.citibank.online net.edgekey.com.citibankonline.citiretailservices.san net.edgekey.com.citibankonline.mobilelatam.san net.edgekey.com.citibankonline.mobile.san net.edgekey.com.citibankonlineqa.citimobileuat1.san net.edgekey.com.citibankonlineqa.uat1.banamex.portal.san net.edgekey.com.citibankonlineqa.uat.colombia.san net.edgekey.com.citibankonlineqa.web-jfp-qa net.edgekey.com.citibank.uat1.globalcommonbuild net.edgekey.com-v2.citibankonline.digitalmarketing.cdn net.edgekey.eu.citi.ipb.citibankonline net.edgekey.hu.citibank.mobile net.edgekey.hu.citibank.www net.edgekey.id.co.citibank.mobile net.edgekey.id.co.citibank.www net.edgekey.in.co.citibank.mobile net.edgekey.in.co.citibank.online.www net.edgekey.in.co.citibank.test.www net.edgekey.in.co.citibank.www net.edgekey.my.com.citibank.mobile net.edgekey.my.com.citibank.www net.edgekey.pe.com.citibank.www.san net.edgekey.ph.com.citibank.www net.edgekey.pl.citibank.mobile net.edgekey.pl.citibankonline.san net.edgekey.pl.citibank.onlineuatpl net.edgekey.ru.citibank.mobile net.edgekey.ru.citibank.production.www net.edgekey.ru.citibank.uat net.edgekey.ru.citibank.www net.edgekey.th.co.citibank.mobile net.edgekey.th.co.citibank.www net.edgekey.tw.com.citibank.mobile net.edgekey.tw.com.citibank.portaluat net.edgekey.tw.com.citibank.www net.edgekey.ve.com.citibank.www.san net.hldnyx.jp.co.citibank.www net.hpcorp.americas.citibankc net.kcyxzx.com.citibank net.kcyxzx.com.pissedconsumer.citibank net.loginp.citibankcards net.loginu.citibankinternetbanking net.omtrdc.sc.d2.com.citibank net.omtrdc.sc.d2.ssl.com.citibank net.site88.latamcitibank news.citibank nf.fr.citibank-de-nicaragua-n7r nf.fr.citibank-de-panama-bw1 nf.fr.citibank-financial-statements-fe6 nf.fr.citibank-la-plata-g7x nf.fr.citibank-locations-illinois-3bz nf.fr.citibank-of-senegal-8fx nf.fr.citibank-online-colombia-ccu nf.fr.citibank-porto-alegre-h9z nf.fr.citibank-san-francisco-tni nf.fr.citibank-share-price-rsq nf.fr.citibank-wall-street-t4e ni.com.citibank ni.com.citibank.www nyc.citibank nz.co.citibank one.citibank online.citibank online.citibank-sp online.citibankusa org.citibankgroup org.citibanklocations org.citibankroutingnumber org.citibankstudentloans org.egceducation.online.com.citibank org.sarbl.public.ru.citibank org.surbl.ab.com.citibank org.surbl.ab.ru.citibank org.surbl.ob.ru.citibank org.surbl.sc.ru.citibank org.surbl.ws.com.citibank org.surbl.ws.ru.citibank org.webstatsdomain.sg.com.citibank.ipb.www org.wsheng.com.citibank.www pa.com.citibank pa.com.citibank.www paris.citibank pe.com.citibank pe.com.citibank.www ph.citibank ph.citibank.www ph.com.citibank ph.com.citibankard.www ph.com.citibank.chat ph.com.citibank.front ph.com.citibank.lane ph.com.citibank.left ph.com.citibank.mobile ph.com.citibank.www photo.citibank pink.citibank pk.com.citibank pk.com.citibank.www pl.citibank pl.citibank.cd.home1pl pl.citibank.mobile pl.citibankonline pl.citibank.online pl.citibankonline.july pl.citibankonline.play pl.citibankonline.star pl.citibank.onlineuatpl pl.citibank.online.www pl.citibankonline.www pl.citibank.play pl.citibank.www pl.mybank.citibank-handlowy.www pm.olink.video.citibank-online-bill-payment pm.olink.video.citibank-remote-access-login pm.olink.video.xn--citibank-online----9xob4b5fxa0czct2qncvg porn.citibank press.citibank pro.citibank property.citibank pt.citibank pt.citibank.www pub.citibank red.citibank ren.citibank rent.citibank review.citibank reviews.citibank rich.citibank ro.africadesud.nne0t8ep7o.com.citibank.online ro.africadesud.rjkekam7jj.com.citibank.online ro.africadesud.wcybvxlypa.com.citibank.online ro.africadesud.wildcard.com.citibank.online ro.africadesud.z59lkjuws6.com.citibank.online ro.citibank ro.citibank.www rocks.citibank ru.anketa-citibank ru.blogspot.citibank-india ru.blogspot.citibankstudentloans ru.blogspot.ipbcitibank ru.citibank ru.citibankcards ru.citibank-cards-loans ru.citibanke ru.citibank-ex ru.citibankforum ru.citibankforum.mail ru.citibankforum.www ru.citibank.grand ru.citibank-info ru.citibank-info.mail ru.citibank-info.www ru.citibanking ru.citibanking.mail ru.citibank-karta ru.citibank.mobile ru.citibank.mobile.www ru.citibankonline ru.citibank-online ru.citibank-online.mail ru.citibank-online.www ru.citibank.production.www ru.citibank-russia ru.citibanks ru.citibank.slice ru.citibanks.ns1 ru.citibanks.ns2 ru.citibank.spice ru.citibank.uat ru.citibank.www ru.ruscitibank ru.ruscitibank.mail ru.wwwcitibank ru.yandex.br.com.juriseg.my.com.citibank ru.yandex.br.om.citibank.www ru.yandex.br.org.brasilmedicao.dcvoifc98m.com.citibank.online ru.yandex.br.org.brasilmedicao.nhds9ykz4r.com.citibank.online ru.yandex.br.org.brasilmedicao.sgzyi5psin.com.citibank.online ru.yandex.br.org.brasilmedicao.wj47k9yna3.com.citibank.online ru.yandex.co.com.citibank ru.yandex.com.citibankinggroup ru.yandex.com.citibank.online.www ru.yandex.com.dominguezymarcos.cfwornttwm.com.citibank.online ru.yandex.com.dominguezymarcos.gbyojpr0ac.com.citibank.online ru.yandex.com.dominguezymarcos.jvtkrmtpgc.com.citibank.online ru.yandex.in.co.citibankc ru.yandex.kz.com.citibank ru.yandex.net.citibankloans ru.yandex.org.citibankstudentloan ru.yandex.phl.com.citibank.www ru.yandex.pl.plitibank.citibank ru.yandex.ru.bestblenderpart.odesk-com.com.citibank.google-com-pk ru.yandex.ru.creditcardcitibank ru.yandex.ru.creditcitibank ru.yandex.ru.needserve.tripadvisor-com.com.citibank.ifeng-com ru.yandex.ru.webdesktopnet.gutefrage-net.com.citibank.mtv-com ru.yandex.se.iqf-karlstad.ezlzz2vmrl.com.citibank.online ru.yandex.se.iqf-karlstad.kr4ooiboc5.com.citibank.online ru.yandex.se.iqf-karlstad.ritwaoncbm.com.citibank.online ru.yandex.se.iqf-karlstad.wcybvxlypa.com.citibank.online ru.yandex.tw.com.citibank science.citibank sex.citibank sexy.citibank sg.com.citibank sg.com.citibank.chat sg.com.citibank.citibusiness.www sg.com.citibank.citigold.ipb.www sg.com.citibank.citigold.www sg.com.citibank.ipb sg.com.citibank.ipb.mobile sg.com.citibank.ipb.tank sg.com.citibank.ipb.tram sg.com.citibank.ipb.win sg.com.citibank.ipb.www sg.com.citibank.mobile sg.com.citibank.rank sg.com.citibank.road sg.com.citibank.star sg.com.citibank.wlb sg.com.citibank.wlb.sg.asia sg.com.citibank.wlb.tw.cardtwex sg.com.citibank.www sh.my.com.citibank site.citibank sk.citibank sk.citibank.www soccer.citibank space.citibank store.citibank studio.citibank sucks.citibank sv.com.citibank sv.com.citibank.www systems.citibank tc.subesi.citibank tc.subesi.citibank-izmir tech.citibank th.co.citibank th.co.citibank.basil th.co.citibank.citigold.www th.co.citibank.gray th.co.citibank.july th.co.citibank.mobile th.co.citibank.www tips.citibank top.citibank trade.citibank trading.citibank tr.com.citibank tr.com.citibank.citidirect.www tr.com.citibank.www tr.gen.citibank tt.it.citibank tv.ignition3.8vsgnmlyy3.com.citibank.online tv.ignition3.a.com.citibank.online tv.ignition3.ayaw92qlsh.com.citibank.online tv.ignition3.f9hjpyvj10.com.citibank.online tv.ignition3.tqvbidb1xg.com.citibank.online tv.ignition3.v5eg3ghgta.com.citibank.online tv.ignition3.wetvu7ujvp.com.citibank.online tv.ignition3.wilcard.com.citibank.online tw.com.citibank tw.com.citibank.cardservice tw.com.citibank.fan tw.com.citibank.funds tw.com.citibank.images tw.com.citibank.mobile tw.com.citibank.portaluat tw.com.citibank.walk tw.com.citibank.webatm tw.com.citibank.webatm.pat tw.com.citibank.www ua.citibank ua.citibank.www uk.co.citibank uk.co.citibank.email uk.co.citibank.email.f uk.co.citibank.email.ns.a uk.co.citibank.email.ns.b uk.co.citibank.email.ns.c uk.co.citibank.email.ns.d uk.co.citibank.email.ns.e uk.co.citibank.email.ns.f uk.co.citibank.ipb uk.co.citibank.ipb.citibankonline uk.co.citibank.uatukmarketingsandbox1 uk.co.citibank.uatukmarketingsandbox1.www uk.co.citibank.www us.citibanks us.citibanks.www uy.com.citibank uy.com.citibank.www ve.com.citibank ve.com.citibank.siguiente ve.com.citibank.sitio ve.com.citibank.www vet.citibank vn.com.citibank vn.com.citibank.font vn.com.citibank.mobile vn.com.citibank.star vn.com.citibank.water vn.com.citibank.www wales.citibank wang.citibank website.citibank website.citibanks wiki.citibank xn--3ds443g.citibank xn--45q11c.citibank xn--hxt814e.citibank xn--ses554g.citibank xn--tckwe.citibank xxx.citibank xyz.citibank xyz.citibankadvicetowomen xyz.citibankcashadvance xyz.citibankcreditcard xyz.citibanknetbanking xyz.citibankonline xyz.oowkj17kx7.on.sign.citibank.www xyz.thecitibank xyz.yourcitibankcashadvance
— Joe St Sauver, Ph.D. is a Scientist with Farsight Security, Inc.
