Framing the AkiraBot Framework Under the DNS Lens | WhoisXML API

Framing the AkiraBot Framework Under the DNS Lens

SentinelLABS recently discovered the AkiraBot framework that threat actors crafted to spam website chats and contact forms to users. All that to promote a low-quality search engine optimization (SEO) service since September 2024. The bot uses OpenAI to generate custom outreach messages matching the target sites’ purpose.1

The researchers identified 34 domains as AkiraBot indicators of compromise (IoCs). WhoisXML API expanded the list through a DNS deep dive and, in the process, uncovered:

  • 16 email-connected domains
  • 22 IP addresses, 10 of which turned out to be malicious
  • 17 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

  • [1] https://www.sentinelone.com/labs/akirabot-ai-powered-bot-bypasses-captchas-spams-websites-at-scale/
Try our WhoisXML API for free
Get started