WhoisXML API Blog

What Is DNS Tunneling and How to Detect It

You may have heard of notorious malware variants like Zloader using DNS tunneling for command and control (C2). Instead of making regular web requests, this malware uses the Domain Name System (DNS) to communicate with its C2 servers, and this allows malicious traffic to bypass network security, such as firewalls and intrusion detection systems (IDS).

But wait, DNS doesn’t support arbitrary data transfer like HTTP, does it? Well, it doesn’t, but DNS tunneling is a workaround for that. In this post, we break down DNS tunneling for you, including how it works and how to detect it – both from within an organization’s network and from outside it. 

17 Best Free OSINT Tools for Cyber Investigations

There are plenty of free or almost-free OSINT tools you can find online — ChatGPT can provide you with quite a list. But, as often happens with ChatGPT, some of those tools simply don’t exist, some don’t work anymore, and some provide low-quality data. 

In this post, we have collected several OSINT tools that actually work quite well for different cyber research purposes, grouped according to their primary use cases. All of these tools could be very handy for different tasks such as cybercrime investigation, threat hunting, offensive cybersecurity exercises, and more.

June 2025: Domain Activity Highlights

WhoisXML API analyzed 9.8+ million domains registered between 1 and 30 June 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by 51.7+ billion domains from our DNS database’s A record full file dated 5 June 2025.

Next, we studied the top TLDs of 1.0+ million domains detected as indicators of compromise (IoCs) this June.

Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

Handling CSV Files with CR/LF Line Endings

Ed Gibbs, VP of Research, whoisxmlapi.com

Issue Overview

CSV files containing CR/LF (carriage return/line feed) line endings can cause parsing errors with certain CSV-to-JSON conversion tools. This commonly occurs when CSV files are created on Windows systems, which use CR/LF (\r\n) line endings, while many Unix-based tools expect only LF (\n) line endings.  This applies to various datafeeds WHOISXMLAPI provides such as WHOIS, Netblocks, and IP Geolocation.

Ingesting IP Netblocks with DynamoDB

Introduction

Overview

DynamoDB is Amazon's fully managed NoSQL database service that's designed for high-performance applications at scale. DynamoDB is known for its single-digit millisecond response times, automatic scaling, and built-in security features.

WhoisXML API Participates in InfoSec 2025

Brendan O'Doherty, in charge of Intelligence Partnerships at WhoisXML API, recently attended Infosecurity Europe 2025 held at ExCeL London on 3–5 June. He joined more than 13,000 attendees united in the overarching theme of building a safer cyber world, which deeply resonated with WhoisXML API’s vision.

The event celebrated its 30th anniversary, bringing together cybersecurity leaders, solution providers, and technologists to discuss cyber strategies, the evolving threat landscape, and innovations in cyber defense. Below are some of the recurring themes and our key takeaways from the event.

A Lookup Tool Set for Conducting Cybercrime Investigations

Our research team has done many threat reports where we analyze published indicators of compromise (IoCs) in an effort to identify more threat artifacts or cyber resources likely associated with the threat actor infrastructure. 

In one threat report, our researchers examined around 290 IoCs related to seven new threat groups listed on MITRE’s ATT&CK page. This led to the discovery of more than 5,000 potentially connected artifacts that have not yet been publicized at the time. We’ll use this report as an example to explain how we do it. 

9 Best DNS Lookup Tools for Malware Analysis and Phishing Investigations

For cybersecurity researchers, the DNS hides a treasure trove of data. It offers insights to identify malicious domains, map attacker infrastructure, detect fast flux, and identify typosquatting domains. But it also requires knowing where to look and what to analyze. 

In this post, we cover different the best DNS lookup tools for different types of lookups and what types of investigations they can help with.