WhoisXML API Blog

Uncovering Criminal Bulk Registration Activities with Bulk Domain Name Checkers

To propagate cyberattacks, threat actors use domain generating algorithm (DGA) as an evasion tactic. This algorithm, executed through various subroutines, involves switching or dropping thousands of domains in seconds.

The relative ease with which cybercriminals can purchase domains in bulk makes it possible for them to accomplish DGA-enabled attacks. Dirt-cheap prices and lack of identity verification enable hackers to own domains while also staying anonymous.

The Equifax Settlement Case: Shielding Financial Service Customers from Phishing with Domain Research Monitoring

Data breaches continue to plague organizations today. In the first six months of 2019 alone, 3,813 data breaches were recorded, exposing more than 4.1 billion records. This figure translates to more than a 50% increase in victim volume over the past four years. Worse still, three of these recently recorded data breaches made it to the all-time list of top incidents.

Of all these unfortunate events, we decided to take a closer at Equifax’s case. First, because it has been the financial sector’s biggest breach victim to date. Second, because it shows how cybercriminals insist on exploiting every vulnerability there is. It’s indeed possible that malicious entities are now trying to trick victims into disclosing more personally identifiable information (PII) on fake Equifax settlement websites.

5 Ways to Maintain Brand Consistency

Brand consistency is a practice of presenting brand messages in a way that is fully synchronized with your brand’s strategy, mission, and values.

Maintaining brand consistency is easier said than done, especially in the digital environment. So how do you make sure that your brand is presented in the best possible light, consistent with your identity and goals?

Read this guide to find out.

Why Brand Consistency is Important?

Without consistency, there is no brand - it is as simple as that. You can have millions of dollars in your marketing budget and an amazing, inspiring message, but if you don’t communicate it in a way that’s going to make this message stick around, you’ll be wasting your time and money.

Amplify a blacklist with the Typosquatting Data Feed. A technical blog

The Typosquatting Data Feed list groups of domains that have been registered on the same day, and whose names are similar to each other within the group. A question might be: why buy such data. Here we illustrate the power of the data set through a very efficient application to detect malicious domains. A simple Python code will be presented to illustrate how it works. Then we will illustrate its efficiency by applying it to the PhishTank data feed, demonstrating that it is capable of revealing a tremendous amount of additional domains.

Detection of malicious domains is an important and hard task in IT security. It is the major ingredient of protection against phishing, malware, botnet activity, etc. The most reliable approach to the problem is the use of blacklists such as PhishTank or URLhaus, where a community or a specialized group of experts publish a list of domains or URLs that are confirmed to be malicious. PhishTank, for instance, is community operated: a number of benevolent activists do a great favor to all of us by checking suspicious domains and reveal their phishing activity.

A blacklist of domains is not only useful for direct use in firewalls or spam filters though. It can also serve as an input for methods that can find additional domains strongly related to the blacklisted ones, thus being suspicious. By "amplification" of a blacklist we mean its extension with such a method. With WhoisXML API's recently introduced Typosquatting Data Feed such an amplification can be easily achieved. Some of the domains in the original blacklist will turn out to be the "top of the iceberg": we shall find a relevant set of related domains.

Fraud and Identity Theft Prevention By Using an IP Location Database

Offering high-quality customer experience (UX) often means personalizing and customizing products and services. Businesses have to collect personally identifiable information (PII) from customers, such as date of birth, credit card details, addresses, and other information. This is also the kind of data fraudsters are after so they can carry out identity theft.

Identity theft isn’t even a new crime, which sprung up from the digitalization of business processes. It has been around since the early 1900s. Until recently, fraudsters emptied contents of garbage bins to find copies of legal documents with personal information.

How a Reverse IP & Domain Lookup Can Save Organizations from Stale DNS Records

Every website that can be accessed on the Internet comes with an IP address that points to a specific domain name. Each domain-to-IP address mapping is recorded in the Domain Name System (DNS), which makes it possible for users to not have to remember numeric addresses to reach a particular website while still letting DNS resolvers do their matchmaking work. And for this to happen, a DNS record contains many crucial details about a website accessible via the World Wide Web.

Sorting Gray Alerts Using Domain Reputation Scores

The job of managed detection and response (MDR) teams, as their name suggests, is not limited to detecting cybersecurity threats. They are also responsible for carrying out the right actions in response to specific threat alerts.

If there were less than a hundred alerts, and they were all black or white, everything would go smoothly; at least when it comes to following up with the appropriate responses. Alerts with a definite malicious component would then be processed easily to quarantining and blocking stages, while benign alerts are ignored. But the cybersecurity landscape has become more complicated than that, for several reasons, including the facts that:

Typosquatting Daily Data Feed: the new enabler in the fight against phishing and malware

One result of our reseach and development is the introduction of the new "typosquatting data feed", an innovative data set based on our long-standing experience with cybersecurity and the Domain Name System. In what follows we will demonstrate how this new resource can be used efficiently in the fight against spam, phishing and malware.

The main idea behind the new data feed is the observation that domain names which were registered on the same day and have similar names have an increased likelihood of being involved in a range of IT scams, including typosquatting attacks, domain name hijacking, and also phishing and malware. So, we have developed a technology for finding these groups of domain names.