WhoisXML API Blog

Making Email Security Smarter with Domain Intelligence

More than 4 billion people checking their emails daily represents a goldmine for attackers. No wonder phishing remains one of the biggest threats today, pushing email security to the top of organizations' cyber priorities.

But here's the kicker—90% of malicious emails can slip through email security standards, such as the Sender Policy Framework (SPF); the DomainKeys Identified Mail (DKIM); or Domain-Based Message Authentication, Reporting, and Conformance (DMARC).

While many email security providers are out there, those offering a multilayered approach can offer more.

Introducing Server-to-Server OAuth to Secure API Integrations

We’re thrilled to announce the availability of Server-to-Server OAuth for all our API users. Using this authentication method helps developers build robust integrations without compromising security and efficiency.

Server-to-Server OAuth or two-legged OAuth eliminates user interaction for authentication, making it ideal for automated workflows. It simplifies API integration by allowing a server to directly request and manage access tokens. The authorization method is also designed to handle high-volume API requests, supporting application scalability.

Name Server Concentration: Who Controls the Domain Name System?

Name servers (NSs) play a crucial role in how the Internet works, directing traffic to the correct destinations. Specifically, NS records tell recursive resolver servers which authoritative NS is responsible for a specific domain name. The resolver would then contact the authoritative NS to obtain the domain's corresponding IP address.

While having a small number of entities control a large portion of the DNS can increase efficiency, it could also result in choke points, where a single disruption could significantly impact a large portion of Internet traffic.

Domains Only Data Feed Is Now Available for Newly Registered Domains Ultimate Users

A new type of data feed has been made available for users with a Newly Registered Domains (NRD) Database Ultimate subscription, allowing them to obtain new domain intelligence faster. 

Specifically, the new Domains Only data feed gives access to files containing all domains from the Ultimate data feed, along with those added to or deleted from a given day’s zone files compared with the previous day.

WhoisXML API Data Is Now Available on ProjectDiscovery Subfinder

WhoisXML API is excited to announce a new integration with ProjectDiscovery, an open-source-led security company that specializes in the detection of new, exploitable vulnerabilities.

This new collaboration brings WhoisXML API's comprehensive subdomain data to ProjectDiscover's Subfinder, a tool designed to discover valid subdomains for any domain name through passive enumeration.

This integration further expands Subfinder's data coverage, enabling users to use WhoisXML API intelligence to perform thorough and accurate subdomain enumeration for asset discovery, penetration testing, bug bounty hunting, security assessments, threat detection, and other critical security processes.

WhoisXML API Tech Announcement Service Is Now Available for Data Feed Users

We’re excited to announce that WhoisXML API now offers a tech announcement service page to help customers keep track of events, such as the release of new or revised data feed files. The service aims to provide users access to relevant product updates covering events related to Newly Registered Domains, the Typosquatting Feed, the Early DGA Detection Feed, the Early Warning Phishing Feed, and the Quarterly WHOIS Database.

The tech announcement service is available on two channels. The RSS feed can be accessed at https://www.whoisxmlapi.com/tech_announce/announce.rss, while the JSON list is available at https://www.whoisxmlapi.com/tech_announce/announce.json.

June 2024: Domain Activity Highlights

The WhoisXML API research team analyzed more than 7.5 million domains registered between 1 and 30 June 2024 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

After that, we determined the top TLD extensions used by the more than 58.2 billion domains from our DNS database’s A record full file released in June 2024.

We also studied the top TLDs and associated threat types of more than 1.1 million domains detected as indicators of compromise (IoCs) in June.

Finally, we summarized the findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

Exploring IoCs and Their DNS Narratives

No matter how stealthy attackers try to be, they almost always leave a trail behind—digital breadcrumbs known as “indicators of compromise (IoCs)” after a cyber attack or an attempted intrusion.

Let's take the Black Basta ransomware attacks as an example. Cybersecurity authorities like the Cybersecurity and Infrastructure Security Agency (CISA) identified hundreds of IoCs associated with this ransomware-as-a-service (RaaS) variant. These IoCs include cyber resources like file hashes, domain names, and IP addresses, and serve as digital footprints pertaining to the attackers’ activities. They provide invaluable clues for cybersecurity professionals, helping them understand what happened and prevent similar attacks in the future.