WhoisXML API Blog

Jonathan Zhang, WhoisXML API: “DNS abuse instances are among the top threats we see when monitoring domain and DNS activity”

While the world is facing major crises of the century, cybercriminals are taking advantage of the situation and are rapidly setting digital traps in numerous creative ways. Cyberattacks affect not only individuals but also organizations and governments, begging for top-notch tools to help combat the threats. 

The Cybernews team has invited Jonathan Zhang, the CEO of WhoisXML API, an Internet and security data aggregator, to discuss the importance of data and the current situation in the cybersecurity field. 

May 2022: Elon Musk Buys Twitter, Mother’s Day Celebration, the Return of Operation Dream Job, and NFT Mania

We detected significant domain and DNS activity relevant to some of the top current events seen in April 2022. Check out the overview below, and feel free to download the dedicated threat reports where available.

April 2022: Digital Spillovers of War, Oscars Slapping Fiasco, and Tax Season Frenzy

Here are some of the top events in March 2022 for which we detected significant connected domain and DNS activity. See below for an overview, and feel free to download the dedicated threat reports where available.

Secure Your SSH Server with iptables and IP Netblocks API

Secure shell (ssh) is the typical tool for getting secure command-line access to Linux (and other Unix flavor) systems. Notably, most Linux-based servers are administered remotely via ssh access. Hence the security of the ssh service is of paramount importance, especially since it is often a very attractive part of the attack surface of an organization. 

The present blog provides a discussion on setting up efficient firewall rules for the ssh service, and extending the whitelist easily with the help of WhoisXML API's IP Netblocks API. The method also works for other services using inbound tcp connections. We discuss a typical iptables firewall on a Linux system. Basic expertise in Linux tools and firewalls is assumed. The recipe works as it is, or with minor modifications also on other systems. 

WhoisXML API Transforms Now Available on Maltego

Among the first obstacles in the way of cybercrime investigations is evidence gathering. Questions like “Where can we find the correct data for investigation?” and “Is the data we gathered enough to identify a cybercriminal?” often bug investigators and forensic teams. Without accurate and sufficient evidence, diagnoses would mostly remain assumptions and theories.

Maltego addresses this issue by employing various threat intelligence sources, which now include WhoisXML API, one of the largest domain and IP intelligence providers. With WhoisXML API transforms, Maltego enables investigators and researchers to include current and historical WHOIS and Domain Name System (DNS) records of IP addresses and domains in their investigations.

The Domain Research Suite (DRS) Guide for Journalistic and Media Research

As an aggregator of WHOIS, DNS, and IP data, WhoisXML API can help back up journalistic investigations with verifiable online facts about domains and websites. Researchers and media professionals can use our 9-in-1 hosted Domain Research Suite (DRS) platform to investigate suspicious domains, detect domain registration trends, keep track of the government’s or private sector’s actions towards errant websites, and more.

Getting Started with WhoisXML API’s Newly Registered & Just Expired Domains Database

WhoisXML API’s Newly Registered & Just Expired Domains Database (NRD Database) has a new and improved version. NRD 2.0 features the following changes from NRD 1.0:

• Outputs now come in JSON and CSV.
• A file dedicated to statistics can be downloaded along with the data.
• NRD 2.0 has more data sources and covers more TLDs, giving you daily access to over 1+ million records.  
• New subscription plans are available to meet diverse data needs.
• Users enjoy a concise and consistent file and directory structure across different subscription plans.

Learn more about NRD 2.0 in this comprehensive guide.

Managing Domain Attack Surfaces in the Financial Sector with WhoisXML API

While the cybersecurity landscape constantly evolves, the targets remain consistent. Among the hardest hit by cyber attacks is the financial services industry. In Verizon’s 2021 Data Breach Investigations Report (DBIR), for instance, 65% of security incidents in the industry resulted in confirmed data disclosure.

Mitigating this problem begins by determining where the threat actors are attacking from—inside or outside? Identifying attack vectors is also pertinent.

Threat actors in the financial sector vary. Some are institution insiders and partners, while 56% are external parties. The top attack vectors are phishing and other social engineering campaigns.

One of the keys to a digitally safer financial industry is properly managing as many external attack vectors as possible. External Attack Surface Management (EASM) Solutions that uncovers and addresses vulnerable and dangerous Internet-facing assets, can help achieve this feat.