Challenge

Phishing Investigations Require Easy Access to Accurate Domain Registration Data

Incident Response Analysts at Access Now work with civil society to identify, collect, and preserve evidence, and to expose advanced threats and attacks, which include sophisticated spear-phishing campaigns targeting activists, journalists, and human rights defenders for their truth-telling and accountability work. The primary hurdles involve uncovering Tactics, Techniques, and Procedures (TTPs), pivoting between domains linked to the same campaign, and achieving accurate attribution. 

The Helpline required reliable methods to efficiently access and search WHOIS records or track registrant email reuse, to reduce the time and increase the accuracy of its investigations. A limited ability to effectively search for shared registration data meant that related phishing domains could easily be overlooked, leaving human rights defenders exposed to ongoing threats and hindering the Helpline's ability to provide timely and comprehensive protection to those at risk.

Solution

Automated WHOIS Queries Through the MCP Server

In 2025, Access Now incorporated WhoisXML API’s WHOIS API and MCP Server into their investigative workflow. Utilizing the Gemini CLI, analysts performed automated WHOIS lookups and interactively queried data to identify registrant email reuse across multiple suspicious domains. 

The team had access to clean and structured records that allowed them to enrich phishing indicators with much-needed ownership context. The implementation proved straightforward, empowering analysts to rapidly analyze suspicious domains and pivot to related infrastructure, effectively mapping the global phishing campaigns.

Results

Accelerated Response and Enhanced Visibility

The partnership has significantly bolstered Access Now’s incident response capabilities, yielding the following outcomes: 

  • Significant efficiency gains: Analysts achieved approximately 60% time savings compared to manual WHOIS lookups. The ability to query WHOIS data programmatically reduced manual workload and minimized the risk of missing related phishing domains.

  • Enhanced infrastructure visibility: The team gained superior visibility into domain ownership patterns, facilitating the faster identification of related phishing domains through registrant email reuse.

  • Actionable intelligence: Enriching phishing indicators with ownership context strengthened investigative analysis and supported more informed decision-making for Helpline users.

1. Challenge 2. Solution 3. Results