Leading Threat Intelligence Exchange Platforms Integrate WhoisXML API’s WHOIS, IP, and DNS Data

Threat intelligence exchange platforms help organizations make sense of the threats they could be exposed to in support of detection and mitigation efforts and incident response processes. Yet to provide enterprise users with comprehensive and holistic information about risky Internet properties, security platform vendors glean data from a wide variety of sources.

Therein lie major challenges. Collecting WHOIS, IP, DNS, and subdomain data in meaningful ways requires dealing with millions of DNS and domain queries weekly, and establishing contractual relationships with hundreds, if not thousands, of domain registrars, Internet registries, and ISPs. On top of this time-consuming process come formatting and compatibility issues, as different Internet entities typically use different data formats. That translates to billions of rows of data that require extraction and parsing into a uniform format.

In light of these challenges, various threat intelligence exchange platforms have integrated WhoisXML API’s ready-to-use and well-parsed data gathered for more than 12 years—consisting of 16.7 billion WHOIS records, 2.3 billion subdomains, and 13.1 million IP netblocks in total.

How WhoisXML API Data Supplements Threat Intelligence Platforms

The primary benefit of data that is already in a parsed and consumable format is the ease of integration into threat intelligence exchange platforms. From there, it generally takes engineers only a few weeks to include the data from WhoisXML API to their security platforms. In contrast, obtaining the same data sets from numerous entities and then parsing and turning the information into a platform-friendly format could take years.

Several threat intelligence platforms are already using our data sources, one example of which is Maltego that implemented WhoisXML API transforms for use cases, including typosquatting investigation, reverse footprint expansion, and domain ownership identification.

Source: Maltego

Another example is IBM X-Force Exchange, which also supplements the findings of its risk reports with WHOIS data:

Other data points can be gleaned from WhoisXML API’s domain WHOIS, IP and DNS databases, as shown in this third example—a passive reconnaissance platform created by CyberIQ:

What Are the Main Use Cases for Threat Intelligence Platforms?

With access to WhoisXML API’s data sources, threat intelligence platforms can:

Map Out Digital Footprints

WHOIS Data

It is possible to link all domains containing a particular email address or other registration details in their WHOIS records, which in turn can sometimes help security teams make sense of a cyber incident where suspicious Internet entities are involved. By looking at commonalities in domain registration records, threat intelligence solutions can expand data points for more extensive cyber investigations.

IP/DNS Intelligence

An IP address entered into a cyber threat intelligence platform can also have its digital footprint mapped with the help of historical DNS data. The platform can list all domains that resolve to the IP address, giving users aa understanding of which of them could have been weaponized. The footprints can further be reinforced by IP geolocation data and IP range ownership details. The latter can ultimately help in taking down the IP address if it proves malicious.

Subdomain Data

Intelligence from WhoisXML API also includes subdomains, which can be a major part of an entity’s domain footprints. It expands the analysis of threat intelligence platforms and grants users access to information that is often hidden as part of a domain’s infrastructure.

Domain Name System Associations

Domains that share the same DNS data, such as nameservers and mail servers, may be managed by only one entity. Thus, they can be included in each other’s overall digital footprints. Such associations provide security teams and cybercrime investigators with more data points to work with.

Deepen the Context of Domain Names

With WHOIS data, threat intelligence platforms help users add context to domain names. It helps cybersecurity teams and investigators answer questions, such as:

• Who owns or used to own the domain name?
• Where is the registrant located?
• Are there noteworthy changes in the domain’s registrant, registrar, and nameservers?
• Was the domain name registered in bulk?

Monitor New Digital Properties

Some threat intelligence exchange platforms’ algorithms may take into account the age of a domain for reputation scoring. In this case, tracking new domain registrations is helpful, which is possible with the aid of domain WHOIS data.

Moreover, enriching threat intelligence platforms with DNS data allows for the detection of new subdomains, including the dates they were first seen and last updated. Recent IP netblock activity can also be monitored, which includes their relevant contact details, geolocation, and Autonomous System (AS) record details.

Uncover Suspicious Changes and Updates

Changes in domain registration records, IP allocations, and DNS resolutions happen all the time. However, some uncharacteristic updates picked up by a threat intelligence platform may be telltale signs of suspicious activities. At the very least, these changes can present opportunities for cyber attackers.

For instance, legitimate domains that are left to expire may be re-registered by threat actors to be subsequently used in phishing and business email compromise (BEC) scams. Integrating domain, IP, and DNS intelligence sources into threat intelligence exchange platforms can enable it to detect:

• Dropped domain names
• Unexpected IP allocation dynamics
• Changes in domain name status
• New mail servers and nameservers
• Last recorded update in IP or domain resolution
• Sudden content resolution of dormant domains and subdomains

WhoisXML API continues to power cyber threat intelligence platforms, enabling security teams to enrich cybersecurity investigations and identify new artifacts based on known indicators of compromise (IoCs).

Contact us at for questions you may have about integrating WhoisXML API’s domain WHOIS data – or visit the following pages to learn more about integrations and our Enterprise Security Domain and IP Intelligence package.