Blog & How To Guides | WhoisXML API

WhoisXML API Blog

Managing Domain Attack Surfaces in the Financial Sector with WhoisXML API

While the cybersecurity landscape constantly evolves, the targets remain consistent. Among the hardest hit by cyber attacks is the financial services industry. In Verizon’s 2021 Data Breach Investigations Report (DBIR), for instance, 65% of security incidents in the industry resulted in confirmed data disclosure.

Mitigating this problem begins by determining where the threat actors are attacking from—inside or outside? Identifying attack vectors is also pertinent.

Threat actors in the financial sector vary. Some are institution insiders and partners, while 56% are external parties. The top attack vectors are phishing and other social engineering campaigns.

One of the keys to a digitally safer financial industry is properly managing as many external attack vectors as possible. External Attack Surface Management (EASM) Solutions that uncovers and addresses vulnerable and dangerous Internet-facing assets, can help achieve this feat.

Continue reading

Scoping the Domain Asset Surface of Today’s Most-Impersonated Brand (Hint: That’s a Bank)

Microsoft often lands at the top of global lists of most-impersonated brands over time. But that’s not always the case as per this research by Vade in which Crédit Agricole was identified as phishers’ favorite.

Building on this finding, we took a closer look at look-alike DNS Internet assets to check if they could be possible contributors to Crédit Agricole becoming a favored phishing target. By scoping part of its DNS attack surface, we hope to shed more light on the subject from a domain registration perspective. Could the volume of typosquatting domains have anything to do with the occurrence?

Continue reading

Demonstrating bulk reverse passive DNS lookup with PowerShell for IT security investigations: the case of the Phorphiex botnet

IP addresses are straightforward input data for IT security investigations: they are technically necessary for nodes of the Internet to communicate. Hence, if they are not deleted in some tricky way after cybercrime has been committed, or they are to be found in any of the logs before the commitment, they help a lot to unfold what has actually happened. 

IBM Xforce exchange is a forum reporting many security incidents that are relevant for those who are in charge of maintaining IT security. In the present blog we shall pick one of their reports and check how we can extend the given information with WhoisXML APIs using PowerShell which comes installed on Windows and can be used on Linux and Mac OS X, too. We assume lower intermediate skills of PowerShell programming to follow the description below. 

Continue reading

What Is Subdomain Takeover and How Does It Happen?

As an extension of a domain name, subdomains play an essential role in the Domain Name System (DNS). Some websites like Wikipedia offer content in different languages using them—en[.]wikipedia[.]org, es[.]wikipedia[.]org, and de[.]wikipedia[.]org, among many others.

Websites can also be segmented by category through subdomains, and sometimes point to third-party-hosted services. For instance, blog[.]example[.]com could contain content hosted by blogging platforms like WordPress, while shop[.]example[.]com could point to e-commerce platforms like Shopify.

While these use cases are helpful and demonstrate the value of subdomains, threat actors can sometimes take control of them and pose threats to website owners and visitors alike. This post explains how, and tackles a specific threat called a “subdomain takeover.”

Continue reading

Using WhoisAPI services from PowerShell: an invitation

PowerShell is a powerful cross-platform interpreter for scripting that can be used for automating the tasks. On Windows systems in particular, it is the primary and native tool for system administration, data processing, and many more activities. The possibilities range from simple scripts to implement command-line solutions to large, object-oriented tasks. 

This blog is an invitation to use WhoisAPI's services in PowerShell. This consists of using RESTful APIs, illustrating the power of the actual services, especially in security and domainer applications. The presentation is aimed at beginners with a very basic background in programming, and no background in PowerShell is assumed. However, experts of PowerShell who have not used RESTful APIs yet, and experts with a UNIX background making their first steps with PowerShell may also find it useful. 

Continue reading

13 Ways to Increase Brand Reputation and Protect It

When talking about brand reputation, one of the first things that come to mind is reviews. What are customers saying about your product or service? While that is true, there is more to a brand’s reputation than racking up positive reviews. We delved deeper into brand reputation in this post and provided some actionable tips and valuable tools to manage it effectively.

Continue reading

Top 5 Use Cases of WhoisXML API’s New Website Categorization API

WhoisXML API’s website categorization products have been helping organizations determine the authenticity and reliability of sites by scanning the meta tags and content of more than 152 million websites. The machine learning (ML)-driven process allows organizations to detect suspicious domains, align their site categories with their marketing messages, and target the right leads, to name a few.

Today, the tools have been made more massive by adopting the classifications used by the Internet Advertising Bureau (IAB). IAB’s content classification taxonomy has become a standard in the industry, along with other solutions that aim to promote brand safety, ad fraud prevention, and consumer privacy.

Besides the number of categories, Website Categorization Lookup and Website Categorization API also have improved functionalities that provide users with much-needed accuracy and confidence.

Continue reading

WhoisXML API Now Offers 6 Files for its DNS Database Download Service

WhoisXML API made its DNS database download available in six different files, each for different DNS record types. Doing so makes the DNS database files easier to integrate and analyze and enables particular use cases.

The resource records you can download as database files are:

  • A records: An A record directs a domain or subdomain to an IP address. It is possibly the most basic type of DNS record, as all domains should resolve to an IP address to become accessible.
  • Mail exchanger (MX) records: This type of record specifies the mail server where email messages meant for a specific domain are accepted.
  • Nameserver (NS) records: The NS record determines the authoritative DNS server for the domain name.
  • Text (TXT) records: This type of DNS record was initially allotted for human-readable information about a domain that serves as notes for administrators. Its use has, however, evolved to include serial numbers, codes, and server names.
  • Canonical name (CNAME) records: A CNAME allows website administrators to provide aliases to domain names by pointing them to another domain. The domain blog[.]example[.]com, for example, can be given the alias or CNAME example[.]com.
  • Start of Authority (SOA) records: SOA records contain administrative details about a particular domain’s zone. This record helps manage zone transfers and contains the primary nameserver, serial numbers, and timestamps.

This tutorial looks into the six types of DNS databases now available for download.

Continue reading
Try our WhoisXML API for free
Get started
Have questions?

We are here to listen. For a quick response, please select your request type or check our Contact us page for more information. By submitting a request, you agree to our Terms of Service and Privacy Policy.

Or shoot us an email to