The Danish Broadcast Organization Exposes the WHO Behind Human Trafficking

WhoisXML API continues to partner with journalists, scholars, security researchers, and other entities working toward the goal of a cybercrime-free Internet. Among our most recent collaborators is Aida Kokanovic, a journalism student of Roskilde University in Denmark. She is currently working as an intern at the Danish Broadcast Organization.

We are honored to be a vital part of her ongoing investigative project, “Human Trafficking and Prostitution across Europe,” slated for publishing in 2023. The research project aims to uncover the identities of people who may be behind human trafficking and prostitution.

The Challenge: Exposing the WHO behind Human Trafficking

The Web is filled with ads recruiting women from certain countries to work in Western European cities. They are promised money and good working conditions, among other things, but they usually end up in unfortunate situations.

The actors behind these ads often hide behind the inherent anonymity the Internet provides. However, Aida Kokanovic knew these people needed to register domain names to host recruitment ads.

According to her, “Even though you can connect some information to countries, it’s still hard to remove the cloak of anonymity. And that is where WhoisXML API tools come in. They helped me uncover who is behind some of the web properties.”

The Solution: Mapping Connections through Historical WHOIS Data

Armed with some phone numbers and email addresses she found on suspicious recruitment ads, Kokanovic mapped domain connections using the WhoisXML API Historical Reverse WHOIS transform on Maltego.

She uncovered domain names whose WHOIS records contained the phone numbers and email addresses at one point in time. While the figures constantly changed as the investigation progressed, she uncovered 34 brothels with specific indicators of human trafficking. In addition, she mapped more than 2,000 registrants possibly connected to the domains hosting illegal recruitment ads.

Some initial contact details Kokanovic had led to actual brothels in Western Europe. Others exposed more recruitment and escort websites targeting the same areas where prostitution is generally illegal.

In one investigation, Kokanovic tracked a phone number to the historical WHOIS record of a website hosting an ad for a brothel in Switzerland. The domain had two registrants throughout time, and reverse WHOIS connected their names to several other brothels in the same country.

Kokanovic didn’t have to scour the Web for hours to obtain this data. She thus had this to say about WHOIS History and Reverse Historical WHOIS, “They are so easy to use, accessible, and the data can even be overwhelming. But since the information is well-structured, which is important when conducting such an investigation, analysis wasn’t so hard. I have coding experience, but WhoisXML API’s products only required me to push a button to get all the information that I wouldn’t have gotten anywhere else.”

Internet Safety: A Work in Progress

As Kokanovic’s project proved, Internet safety is a work in progress. Human traffickers and illegal recruiters will continue relying on domain names and websites to lure unsuspecting women, not only in Europe but all over the world.

But while “Human Trafficking and Prostitution across Europe” is set to be concluded and published in a few months, Internet safety needs continuous collaborative efforts.

CEO Jonathan Zhang states, “Threat actors increasingly rely on the anonymity the Internet provides, but it’s possible to trace their digital footprints with WHOIS, DNS, and IP intelligence. Kokanovic’s project showed how that works, effectively embodying our overarching vision of a safer and more transparent Internet.”

We are constantly on the lookout for joint research projects and investigations. Please feel free to contact us for inquiries.