On Mon, May 15, 2023 at 6:42 PM Dave Phelps <tippenring@gmail.com> wrote:

I think it's safe to assume they are selling such data.

https://www.techdirt.com/2021/08/25/isps-give-netflow-data-to-third-parties-who-sell-it-without-user-awareness-consent/

https://www.vice.com/en/article/dy3z9a/fbi-bought-netflow-data-team-cymru-contract

From the second article:

"Team Cymru’s products can also include data such as URLs visited, cookies, and PCAP data"

Really?  From Netflow?

I admit, I'm perhaps a little behind on the latest netflow whiz-bangs, 

but I've never seen a netflow record type that included HTTP cookies 

or PCAP data before. 

Certainly, the products listed on the Team Cymru website don't make any mention 

of including cookies or PCAP data, at least not from what I've been able to 

ascertain from digging through their product listing.

Is there some secret "off the menu" product that allows one to purchase a 

data feed that includes cookies and PCAP data?

Given the pervasiveness of TLS these days, even if they could get it off the remaining unencrypted data I'm not sure it would have a lot of value.

Mike