Research Center

Access our latest research and insights on WHOIS, IP, and DNS data for cybersecurity, data science, and other business purposes through our webinars, podcasts, white papers, threat reports, and videos from the Academy.

Have questions?

Threat Reports

Exposing Bulgaria’s Kyulev Data Leak Hacker

A Bulgarian data leaker managed to access and steal the sensitive data of several high-profile targets. To make matters worse, the hacker had been seen offering access to the compromised database.

To assist the cybersecurity community and law enforcement sector, WhoisXML API threat researcher Dancho Danchev analyzed the threat actor’s digital footprints.

Continue reading

Uncovering a Large Footprint of Fake NordVPN Sites

NordVPN isn’t new to being the target of various scammers. Over the years, we’ve seen malicious campaigns that start with luring users to a fake NordVPN site.1, 2

Anyone looking to subscribe to a VPN service could easily land on a fake site and get a malware infection.

Continue reading

A Closer Look at Active Cyber Jihad Web Properties

Cyber jihad refers to the way extremist terrorists use the Internet to wage war against their enemies.1 Typical targets include the U.S., Western European countries, and Israel.

Experts say waging war is no longer limited to the physical world but has crossed over to the virtual realm. And 67 domains identified as indicators of compromise (IoCs) to recent cyber jihad attacks prove that.

Continue reading

Behind the Flashpoint Intel Site Compromise

Back in 2019, the Flashpoint Intel site suffered from a zero-day attack that caused visitors with JavaScript enabled on their systems to be redirected to an external website with a malware-laced pop-up.1

Continue reading

Alleviating BlackEnergy-Enabled DDoS Attacks

BlackEnergy was originally sold as a crimeware toolkit when it first surfaced in 2007. Since then, it has undergone modifications that have made it one of advanced persistent threat (APT) actors’ go-to attack tools. Used in the Ukraine power grid attack in 2015, the malware effectively used a distributed denial-of-service (DDoS) attack to hide their true goal—data stealing.1 

Continue reading

Trusted by
the smartest
companies

Try our WhoisXML API for free

Get started

Have questions?

We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.

Sales
Technical Support
Account issues
Product customization

Message sent!

We'll contact you shortly.

Oops!

Something went wrong. Contact us via regular email.