DarkNet Market Domain Investigation Webinar with SocialLinks, Jörn Weber and WhoisXML API

To get to the bottom of what’s happening on the Internet, researchers and security investigators need to back their theories with reliable and accurate data. By doing so, they unveil who is responsible for certain cyber events. Such a feat is not always straightforward but is possible with the help of the right tools and data sources.

The Domain Investigation Webinar conducted on 6 August tackled how new WhoisXML API transforms are powering Social Links to address the challenges commonly encountered by forensics investigators. Our very own Sr Director of Business Development Alexander Ronquillo was joined by OSINT expert and Corma managing partner Jörn Weber and SocialLinks project manager Sonya Oronova in this exclusive webinar entitled “How to Find Information Using Domain Records.”

Among other contents, two main investigations are demonstrated:

• A look into the disappearance of Cryptoqueen Dr. Ruja and connected domain names and registration data.
• Operation Bayonet, a law enforcement operation targeting AlphaBay and alleged mastermind Alexandre Cazes as well as other darknet markets.

Check the below video link for full webinar access:

Main Challenges Encountered by Security Investigators

When investigating cybersecurity cases, the answers are often widely scattered. In essence, the challenges that security investigators and companies face can be summed up below.

• Heterogeneous data sources: Data points such as URLs, IP addresses, and domain names require experts to obtain data from different sources. These sources include registrars and hosting companies, among many others. But there are thousands of registrars and even more hosting providers, making data collection complicated. Add Internet service providers (ISPs) to the mix, and investigators and security companies are faced with billions of data points.
• No reliable and standardized data format: While investigators and security companies can invest time negotiating for data with registrars, ISPs, and hosting companies, chances are these entities will provide unparsed data in varied formats. It would take long hours to clean and turn the data into an ingestible form.
• Data privacy: Critical WHOIS data are hidden in most lookups, making it impossible for security companies and investigators to negotiate the right agreements with authoritative sources.

What WhoisXML API Brings to the Table

WhoisXML API addresses each of the issues listed above by collecting and parsing the necessary domain data and turning them into understandable and readily consumable intelligence sources. In the words of Alex Ronquillo:

“Once we collect all the data from the back of the house, there’s a lot of maintenance, cleaning, and parsing of that data so that we turn it into a consistent format so that people can pull it into a platform. Or you can just use the tools in general and get a more formatted response.”

Cybersecurity investigators and forensics companies are not the only ones that benefit from the data that WhoisXML API provides. Investors and market researchers can also use WHOIS data to make informed business decisions.

New WhoisXML API Transforms for Social Links

Social Links is a commercial plugin for Maltego, an open-source forensics software. It has been helping investigators map out evidence in social media and the darknet for five years now. And to provide a broader intelligence, Social Links partnered with WhoisXML API to add 14 new transforms, including the following:

• IP Geolocation
• IP Netblocks
• WHOIS
• WHOIS History
• Reverse IP/DNS
• Reverse MX
• Reverse NS
• Brand Alert
• Domain Availability
• Email Verification
• Reverse WHOIS
• Website Contacts
• Website Screenshots

Social Links integrated these WhoisXML API products so forensics investigators can better visualize cases on Maltego.

Each of these transforms was discussed by Jörn Weber during the webinar. Jörn is a long-time WhoisXML API user and the Managing Director of Corma, a Germany-based investigation agency. During the webinar, he also presented three publicly known cybercrime cases. He used Maltego to demonstrate how the new WhoisXML API transforms of Social Links can help discover relevant data points to deepen investigations.

The key takeaway from the webinar is this: Even when all investigators have to start with is a name, an email address, or a company name, they can still obtain valuable information about the target by checking and visualizing current and historical WHOIS data.