WhoisXML API Blog

WhoisXML API Tech Announcement Service Is Now Available for Data Feed Users

We’re excited to announce that WhoisXML API now offers a tech announcement service page to help customers keep track of events, such as the release of new or revised data feed files. The service aims to provide users access to relevant product updates covering events related to Newly Registered Domains, the Typosquatting Feed, the Early DGA Detection Feed, the Early Warning Phishing Feed, and the Quarterly WHOIS Database.

The tech announcement service is available on two channels. The RSS feed can be accessed at https://www.whoisxmlapi.com/tech_announce/announce.rss, while the JSON list is available at https://www.whoisxmlapi.com/tech_announce/announce.json.

June 2024: Domain Activity Highlights

The WhoisXML API research team analyzed more than 7.5 million domains registered between 1 and 30 June 2024 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

After that, we determined the top TLD extensions used by the more than 58.2 billion domains from our DNS database’s A record full file released in June 2024.

We also studied the top TLDs and associated threat types of more than 1.1 million domains detected as indicators of compromise (IoCs) in June.

Finally, we summarized the findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

Exploring IoCs and Their DNS Narratives

No matter how stealthy attackers try to be, they almost always leave a trail behind—digital breadcrumbs known as “indicators of compromise (IoCs)” after a cyber attack or an attempted intrusion.

Let's take the Black Basta ransomware attacks as an example. Cybersecurity authorities like the Cybersecurity and Infrastructure Security Agency (CISA) identified hundreds of IoCs associated with this ransomware-as-a-service (RaaS) variant. These IoCs include cyber resources like file hashes, domain names, and IP addresses, and serve as digital footprints pertaining to the attackers’ activities. They provide invaluable clues for cybersecurity professionals, helping them understand what happened and prevent similar attacks in the future.

Scripts for Building and Querying Interval Trees with IP Geolocation Database

WhoisXML API now offers scripts for IP Geolocation Database users to easily create and use interval trees for efficient IPv4 and IPv6 geolocation data searches, including a function to check if an IP address falls within any GeoIP range.

WHOIS API Now Supports POST Requests

We're thrilled to announce that WHOIS queries can now be processed through POST requests in addition to the current HTTP GET request method. This new capability offers a more secure way to access domain registration information.

Using POST requests significantly reduces the risk of unauthorized access to API keys, as they encrypt the HTTP message body, including the API key. To illustrate, here is an example of a POST request.

Who Runs Email Communications? A Look at the Prevalence of MX Records

Email remains a vital part of modern communication, with 347.3 billion emails sent and received daily worldwide in 2023. For each email to reach its intended recipient, mail exchange (MX) records direct it to the correct mail server.

While individual email users can create their own mail servers, most people use email services from established email service providers (ESPs) to avoid the complexity of running their own servers. These services typically provide storage, security features, and user-friendly interfaces, all without burdening users with maintenance.

However, some experts are concerned about the concentration of power within a limited number of companies controlling MX records. They warn of potential vulnerabilities if email routing relies heavily on just a handful of providers.

Cyber Threat Detection Gets a Boost with Logpresso and WhoisXML API Partnership

WhoisXML API is thrilled to announce its strategic partnership with Logpresso, an innovative provider of automated security operations platforms headquartered in Seoul, Korea. This collaboration equips Logpresso users with comprehensive domain intelligence through WhoisXML API, empowering them to strengthen phishing domain detection and brand protection capabilities.

As a specialist in security information and event management (SIEM) solutions delivered through the cloud, Logpresso is a valuable partner. Since 2013, the company has conquered the limitations of traditional SIEM solutions and developed a technically advanced platform with superior data analysis and threat detection capabilities.

Leveraging IP Data to Enable Extensive Asset Discovery and Contextualization

Mirroring Sun Tzu’s wisdom, “To know your enemy, you must become your enemy,” today’s cybersecurity landscape demands that security teams see their IT infrastructure through attackers’ eyes. This proactive approach is vital, notably considering the Data Breach Investigations Report (DBIR) finding that 65% of data breaches stem from external sources.

Adopting an attacker mindset enables security teams to identify and address attack vectors early and continuously manage their attack surfaces. This strategy entails asking questions like, “What assets can threat actors see and use as entry points?” and “How can compromising these assets impact other assets?”

External attack surface management (EASM) solutions, especially when supplemented with IP intelligence, can help answer these and other related questions.