Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
At the height of xDedic’s popularity in 2016, it was said to have provided cybercriminals access to 85,000 hacked web servers.1 In early 2019, however, law enforcement agents from all over the world teamed up and took the cybercrime-as-a-service (CaaS) marketplace down. Are all of its traces gone from the DNS?
WhoisXML API sought to find out by expanding a list of 19 xDedic indicators of compromise (IoCs). Our in-depth analysis led to the discovery of:
- 15 email-connected domains, one of which turned out to be malicious
- 126 IP-connected domains, one of which turned out to be malicious
- Nine string-connected domains
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.zdnet.com/article/authorities-shut-down-xdedic-marketplace-for-buying-hacked-servers/