WhoisXML API Blog

Scoping the Domain Asset Surface of Today’s Most-Impersonated Brand (Hint: That’s a Bank)

Microsoft often lands at the top of global lists of most-impersonated brands over time. But that’s not always the case as per this research by Vade in which Crédit Agricole was identified as phishers’ favorite.

Building on this finding, we took a closer look at look-alike DNS Internet assets to check if they could be possible contributors to Crédit Agricole becoming a favored phishing target. By scoping part of its DNS attack surface, we hope to shed more light on the subject from a domain registration perspective. Could the volume of typosquatting domains have anything to do with the occurrence?

Demonstrating bulk reverse passive DNS lookup with PowerShell for IT security investigations: the case of the Phorphiex botnet

IP addresses are straightforward input data for IT security investigations: they are technically necessary for nodes of the Internet to communicate. Hence, if they are not deleted in some tricky way after cybercrime has been committed, or they are to be found in any of the logs before the commitment, they help a lot to unfold what has actually happened. 

IBM Xforce exchange is a forum reporting many security incidents that are relevant for those who are in charge of maintaining IT security. In the present blog we shall pick one of their reports and check how we can extend the given information with WhoisXML APIs using PowerShell which comes installed on Windows and can be used on Linux and Mac OS X, too. We assume lower intermediate skills of PowerShell programming to follow the description below. 

What Is Subdomain Takeover and How Does It Happen?

As an extension of a domain name, subdomains play an essential role in the Domain Name System (DNS). Some websites like Wikipedia offer content in different languages using them—en[.]wikipedia[.]org, es[.]wikipedia[.]org, and de[.]wikipedia[.]org, among many others.

Websites can also be segmented by category through subdomains, and sometimes point to third-party-hosted services. For instance, blog[.]example[.]com could contain content hosted by blogging platforms like WordPress, while shop[.]example[.]com could point to e-commerce platforms like Shopify.

While these use cases are helpful and demonstrate the value of subdomains, threat actors can sometimes take control of them and pose threats to website owners and visitors alike. This post explains how, and tackles a specific threat called a “subdomain takeover.”

Using WhoisAPI services from PowerShell: an invitation

PowerShell is a powerful cross-platform interpreter for scripting that can be used for automating the tasks. On Windows systems in particular, it is the primary and native tool for system administration, data processing, and many more activities. The possibilities range from simple scripts to implement command-line solutions to large, object-oriented tasks. 

This blog is an invitation to use WhoisAPI's services in PowerShell. This consists of using RESTful APIs, illustrating the power of the actual services, especially in security and domainer applications. The presentation is aimed at beginners with a very basic background in programming, and no background in PowerShell is assumed. However, experts of PowerShell who have not used RESTful APIs yet, and experts with a UNIX background making their first steps with PowerShell may also find it useful. 

13 Ways to Increase Brand Reputation and Protect It

When talking about brand reputation, one of the first things that come to mind is reviews. What are customers saying about your product or service? While that is true, there is more to a brand’s reputation than racking up positive reviews. We delved deeper into brand reputation in this post and provided some actionable tips and valuable tools to manage it effectively.

Top 5 Use Cases of WhoisXML API’s New Website Categorization API

WhoisXML API’s website categorization products have been helping organizations determine the authenticity and reliability of sites by scanning the meta tags and content of more than 152 million websites. The machine learning (ML)-driven process allows organizations to detect suspicious domains, align their site categories with their marketing messages, and target the right leads, to name a few.

Today, the tools have been made more massive by adopting the classifications used by the Internet Advertising Bureau (IAB). IAB’s content classification taxonomy has become a standard in the industry, along with other solutions that aim to promote brand safety, ad fraud prevention, and consumer privacy.

Besides the number of categories, Website Categorization Lookup and Website Categorization API also have improved functionalities that provide users with much-needed accuracy and confidence.

WhoisXML API Now Offers 6 Files for its DNS Database Download Service

WhoisXML API made its DNS database download available in six different files, each for different DNS record types. Doing so makes the DNS database files easier to integrate and analyze and enables particular use cases.

The resource records you can download as database files are:

• A records: An A record directs a domain or subdomain to an IP address. It is possibly the most basic type of DNS record, as all domains should resolve to an IP address to become accessible.

• Mail exchanger (MX) records: This type of record specifies the mail server where email messages meant for a specific domain are accepted.

• Nameserver (NS) records: The NS record determines the authoritative DNS server for the domain name.

• Text (TXT) records: This type of DNS record was initially allotted for human-readable information about a domain that serves as notes for administrators. Its use has, however, evolved to include serial numbers, codes, and server names.

• Canonical name (CNAME) records: A CNAME allows website administrators to provide aliases to domain names by pointing them to another domain. The domain blog[.]example[.]com, for example, can be given the alias or CNAME example[.]com.

• Start of Authority (SOA) records: SOA records contain administrative details about a particular domain’s zone. This record helps manage zone transfers and contains the primary nameserver, serial numbers, and timestamps.

This tutorial looks into the six types of DNS databases now available for download.

Get reverse NS (aka passive DNS) records for a list of IPs in Python

Passive DNS introduced by Florian Weimer in 2005 is now a central resource in IP security investigations, security of the operation of the domain name system (DNS), and many more. A Passive DNS database contains observed events whenever an IP resolves to a domain name in a DNS communication. Hence, it is a database independent from the current state as well as the physical infrastructure of the DNS itself. In addition, it contains time information: the date and time when such a resolution was first and last observed; this cannot be found out from the DNS. 

One of the easiest ways to obtain such data is by using WhoisXML API's services. In the present blog, we focus on the reverse lookup: using an IPv4 address we want to reveal the domain names that these IPs belonged to on certain dates.