Alternative Data and the Potential for Stock Market Manipulation

Quick thought:

The use of Alternative Data has exploded in use over the last decade. With many investment firms relying on the data to make countless investment decisions, opportunities may arise to mislead underlying algorithms and models who rely on such data as a primary input.

As a simple example, if a model has identified a publicly traded retailer with sequential order ids, a bad actor may put through thousands of fake, low value ($0.01 tickets) or subsequently canceled orders to have the model/algo think underlying fundamentals are improving in real-time.

It's important to think of the underlying data source. Is it web scraped from a publicly modifiable property (sentiment, inventory, listings)? Is it network data that can be faked or spoofed (traffic, dns records)? I suspect this is an area ripe for manipulation and the SEC (Securities and Exchange Commission) may find it tough to uncover and subsequently enforce.

In conclusion, one needs to understand fully what the source data is and what it's telling you makes sense. Always confirm with other metrics or channel checks.

Tracking $RP RealPage client growth

A cursory glance at the technology stack RealPage uses is a self-hosted portal login for client customers. One can setup a web scraper to mine the top 1 million websites over time and track the percent penetration rate. Derivatively, the portal link source contains a parameter named "propertyId" that is a sequential ID number. Tracking this number's growth over time adds a confirmatory variable as well as allowing for the calculation of client churn.

Simple.

View the raw data tracker for this name at http://www.rookresearch.com

Any questions or comments? E-mail me using the form found to the right.

$EIGI Tracker idea: Follow new customer acquisitions by tracking domain nameserver settings

An Alternative Data research idea for tracking $EIGI's customer growth: When a new domain is registered or transferred to a web host, the first thing that needs to happen is an update of the domain's nameserver settings. By web scraping the number of domains that point to a specific web host over time, I theorize one can estimate the growth of customers.

I decide to use DailyChanges alongside the WayBackMachine to backfill EIGI web host properties.

Note: The above list is currently incomplete. A full list of EIGI's properties can be found @ https://www.reviewhell.com/blog/endurance-international-group-eig-hosting/

View EIGI's and other historical DNS records at Rook Research - Historical DNS Records

Update: Added sources Dec 4th, 2018

Sendgrid $SEND Tracker idea: Predict new customer joins by scraping sendgrid's SPF Records in DNS entries

Using Alternative Data Research (Providers for sourcing hedge funds) tracking Sendgrid growth. When generating a new SPF record in Sendgrid's admin panel I suspect one entry in particular is the underlying User ID (sequential) of the account.

By periodically digging new domains and looking for Sendgrid's TXT records it's possible to estimate their new customer join rate.

And it looks to be the case. A uid from an account registered on 5/21/2018 is 7,622,464. Another from 5/26/2018 is 7,654,903. So current new account join rate is ~6,500/day.

To track active customer growth over time would be a much larger project but easy enough. I would setup a massive dig scraper running it against all .com and .net zone files and see the change in sendgrid's dns presence. Since one would be performing hundreds of millions queries just for one run, I'd probably schedule it on a monthly basis.

Alternatively, one can just create new accounts periodically and create the SPF records directly.

View historical DNS TXT Records at Historical DNS TXT Records | Rook Research

Tracking Adobe's Subscriber Growth by Data Mining DNS Query Data

By: Tom Chmielarz

Alternative Data (DNS) used for $ADBE. When a computer user fires up commercial software, a request is generally sent to a licensing server to confirm a valid license. The data mining will focus on this key action.

 

The first step is identifying specific licensing server's domain names. After packet sniffing on software launch with Wireshark (https://www.wireshark.org/) and confirmation from Adobe support forums (https://forums.adobe.com/thread/1004025) we settled on the following list:

 

*.adobelogin.com

*.services.adobe.com

*.licenses.adobe.com

 

The next step is to calculate what percent of the panel has made a connection to the licensing servers in a given time frame (here, quarterly). This is a bit more involved than it may initially appear. An accurate base count of our own panel's “Active and Real Users” is needed. Simply adding up all the unique IP addresses that have made requests will not work. DNS Amplification Attacks (https://deepthought.isc.org/article/AA-00897/0/What-is-a-DNS-Amplification-Attack.html) have become quite popular in recent years. When directed at the data source, they can significantly skew the real panel count upward. A lot of time and effort would be expended individually parsing out attack events. Instead, calculate the panel size from a list of domains that are (1) heavily queried; (2) correspond to real internet use; and (3) have small ANY response sizes. A few examples that can be used:

google-analytics.com

quantserve.com

ntp.org

akamai.net

msftncsi.com

The data might look something like the following:

 

Note: Not real data. Please do not invest based on the presented chart.

Limitations and things to keep in mind:

• This method will only capture active users. It can't capture those subscribers who haven't used the software in a while.

• Does not differentiate between types of licenses. Creative Cloud and Legacy programs are tracked just the same.

It's all about that fold equity.