RCS and DNS: The NAPTR Record, (Mon, Jul 6th)
ID: ac272640-5e23-5c85-8793-6d8bd27e6247
STIX ID: report--ac272640-5e23-5c85-8793-6d8bd27e6247
Feed Name: SANS ISC Diary
This write-up analyzes how RCS uses DNS NAPTR and SRV records—showing decoded t-shark queries/responses for fp-us-verizon.rcs.telephony.goog, explaining the SIPS+D2T service selection and the NAPTR→SRV→A/AAAA lookup flow—and notes that NAPTR regexes are unused in this observed traffic while suggesting the records may interest researchers and penetration testers.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
