The FIRST DNS Abuse SIG will soon be working on some tools for detecting DNS abuse, and we'll need some datasets to verify them. Do you have a dataset which we could use? Query logs, netflow data, attack signatures, anything that we'd be able to point a tool at, and it verify an abuse type - would be super useful. Get in touch if you think you might be able to help!