WhoisXML API Blog

We are excited to announce that a protocol selector has been added to WHOIS Lookup and WHOIS Search (on Domain Research Suite), giving users more flexibility to choose how to retrieve domain registration data. 

With this new feature, users can select from three protocols—RDAP, WHOIS, and Auto.

You may have heard of notorious malware variants like Zloader using DNS tunneling for command and control (C2). Instead of making regular web requests, this malware uses the Domain Name System (DNS) to communicate with its C2 servers, and this allows malicious traffic to bypass network security, such as firewalls and intrusion detection systems (IDS).

But wait, DNS doesn’t support arbitrary data transfer like HTTP, does it? Well, it doesn’t, but DNS tunneling is a workaround for that. In this post, we break down DNS tunneling for you, including how it works and how to detect it – both from within an organization’s network and from outside it. 

There are plenty of free or almost-free OSINT tools you can find online — ChatGPT can provide you with quite a list. But, as often happens with ChatGPT, some of those tools simply don’t exist, some don’t work anymore, and some provide low-quality data. 

In this post, we have collected several OSINT tools that actually work quite well for different cyber research purposes, grouped according to their primary use cases. All of these tools could be very handy for different tasks such as cybercrime investigation, threat hunting, offensive cybersecurity exercises, and more.

WhoisXML API analyzed 9.8+ million domains registered between 1 and 30 June 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by 51.7+ billion domains from our DNS database’s A record full file dated 5 June 2025.

Next, we studied the top TLDs of 1.0+ million domains detected as indicators of compromise (IoCs) this June.

Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

Ed Gibbs, VP of Research, whoisxmlapi.com

Issue Overview

CSV files containing CR/LF (carriage return/line feed) line endings can cause parsing errors with certain CSV-to-JSON conversion tools. This commonly occurs when CSV files are created on Windows systems, which use CR/LF (\r\n) line endings, while many Unix-based tools expect only LF (\n) line endings.  This applies to various datafeeds WHOISXMLAPI provides such as WHOIS, Netblocks, and IP Geolocation.

Introduction

Overview

DynamoDB is Amazon’s fully managed NoSQL database service that’s designed for high-performance applications at scale. DynamoDB is known for its single-digit millisecond response times, automatic scaling, and built-in security features.

Our research team has done many threat reports where we analyze published indicators of compromise (IoCs) in an effort to identify more threat artifacts or cyber resources likely associated with the threat actor infrastructure. 

In one threat report, our researchers examined around 290 IoCs related to seven new threat groups listed on MITRE’s ATT&CK page. This led to the discovery of more than 5,000 potentially connected artifacts that have not yet been publicized at the time. We’ll use this report as an example to explain how we do it.