Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
CRN¹ named the biggest cyber attacks and breaches of 2026 so far, and we zoomed in on five of them. Two were zero-day exploitation campaigns against edge infrastructure—Cisco Catalyst SD-WAN and Ivanti EPMM. One was the Stryker wiper attack. The last two were ShinyHunters campaigns against the education sector: the Instructure Canvas breach and the Oracle PeopleSoft zero-day.
Mandiant, Google Threat Intelligence Group, Palo Alto Networks Unit 42, and Protos Labs published the underlying analyses.
We extracted domains from the subdomain IoCs and, aided by the WhoisXML API MCP Server², filtered out those owned by legitimate companies plus one on the Tor network. That left 54 IoCs—five subdomains, 14 domains, and 35 IP addresses.
54
Original IoCs Analyzed
Domain and IP indicators from the reported campaign
Key Findings
6
Email-connected domains
13
Additional IP addresses
132
IP-connected domains
753
String-connected domains
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Domain IoC legitimacy check
- Client traffic and typosquatting analysis
- Domain IoC WHOIS and DNS history analysis
- Email-connected domain discovery
- IP and IP-connected domain discovery
- String-connected domain discovery
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.crn.com/news/security/2026/10-major-cyberattacks-and-data-breaches-in-2026-so-far?page=1
- [2] https://main.whoisxmlapi.com/ai/mcp-server