Protocol
protocol:whois_records
Also: historical WHOIS records
Public domain-registration records used by researchers to investigate malware infrastructure.
Public domain-registration records used by researchers to investigate malware infrastructure.
“one of the most typical ways we have been able to figure out who’s involved with a piece of malware is WHOIS records.”
F-Secure USES WHOIS records
F-Secure researchers use WHOIS records, including historical WHOIS records, to help identify people involved with malware.
Explicit Confidence 96% · Mikko Hyppönen EP 74 Details
“one of the most typical ways we have been able to figure out who’s involved with a piece of malware is WHOIS records.”