WhoisXML API Blog

Name Server Concentration: Who Controls the Domain Name System?

Name servers (NSs) play a crucial role in how the Internet works, directing traffic to the correct destinations. Specifically, NS records tell recursive resolver servers which authoritative NS is responsible for a specific domain name. The resolver would then contact the authoritative NS to obtain the domain's corresponding IP address.

While having a small number of entities control a large portion of the DNS can increase efficiency, it could also result in choke points, where a single disruption could significantly impact a large portion of Internet traffic.

Domains Only Data Feed Is Now Available for Newly Registered Domains Ultimate Users

A new type of data feed has been made available for users with a Newly Registered Domains (NRD) Database Ultimate subscription, allowing them to obtain new domain intelligence faster. 

Specifically, the new Domains Only data feed gives access to files containing all domains from the Ultimate data feed, along with those added to or deleted from a given day’s zone files compared with the previous day.

WhoisXML API Data Is Now Available on ProjectDiscovery Subfinder

WhoisXML API is excited to announce a new integration with ProjectDiscovery, an open-source-led security company that specializes in the detection of new, exploitable vulnerabilities.

This new collaboration brings WhoisXML API's comprehensive subdomain data to ProjectDiscover's Subfinder, a tool designed to discover valid subdomains for any domain name through passive enumeration.

This integration further expands Subfinder's data coverage, enabling users to use WhoisXML API intelligence to perform thorough and accurate subdomain enumeration for asset discovery, penetration testing, bug bounty hunting, security assessments, threat detection, and other critical security processes.

WhoisXML API Tech Announcement Service Is Now Available for Data Feed Users

We’re excited to announce that WhoisXML API now offers a tech announcement service page to help customers keep track of events, such as the release of new or revised data feed files. The service aims to provide users access to relevant product updates covering events related to Newly Registered Domains, the Typosquatting Feed, the Early DGA Detection Feed, the Early Warning Phishing Feed, and the Quarterly WHOIS Database.

The tech announcement service is available on two channels. The RSS feed can be accessed at https://www.whoisxmlapi.com/tech_announce/announce.rss, while the JSON list is available at https://www.whoisxmlapi.com/tech_announce/announce.json.

June 2024: Domain Activity Highlights

The WhoisXML API research team analyzed more than 7.5 million domains registered between 1 and 30 June 2024 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

After that, we determined the top TLD extensions used by the more than 58.2 billion domains from our DNS database’s A record full file released in June 2024.

We also studied the top TLDs and associated threat types of more than 1.1 million domains detected as indicators of compromise (IoCs) in June.

Finally, we summarized the findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

Exploring IoCs and Their DNS Narratives

No matter how stealthy attackers try to be, they almost always leave a trail behind—digital breadcrumbs known as “indicators of compromise (IoCs)” after a cyber attack or an attempted intrusion.

Let's take the Black Basta ransomware attacks as an example. Cybersecurity authorities like the Cybersecurity and Infrastructure Security Agency (CISA) identified hundreds of IoCs associated with this ransomware-as-a-service (RaaS) variant. These IoCs include cyber resources like file hashes, domain names, and IP addresses, and serve as digital footprints pertaining to the attackers’ activities. They provide invaluable clues for cybersecurity professionals, helping them understand what happened and prevent similar attacks in the future.

Scripts for Building and Querying Interval Trees with IP Geolocation Database

WhoisXML API now offers scripts for IP Geolocation Database users to easily create and use interval trees for efficient IPv4 and IPv6 geolocation data searches, including a function to check if an IP address falls within any GeoIP range.

WHOIS API Now Supports POST Requests

We're thrilled to announce that WHOIS queries can now be processed through POST requests in addition to the current HTTP GET request method. This new capability offers a more secure way to access domain registration information.

Using POST requests significantly reduces the risk of unauthorized access to API keys, as they encrypt the HTTP message body, including the API key. To illustrate, here is an example of a POST request.