Reverse WHOIS
In cybersecurity, Reverse WHOIS is a technique for discovering all domains registered using the same registrant information (like name, email, or organization) found in a standard WHOIS lookup.
Think of a regular WHOIS search as looking up a phone number to find the name of a house owner. Reverse WHOIS flips that concept around. You provide a name (registrant information), and it finds all the "phone numbers" (domains) associated with it.
Here's why Reverse WHOIS is valuable for security:
Identify unexpected assets: It can help you discover domains your organization might own that aren't officially documented, potentially revealing shadow IT or misconfigured assets.
Investigate potential threats: By searching for domains with the same email address as a known malicious actor, you can identify other domains that might be used for phishing or malware distribution.
Improve threat intelligence: It can provide additional context about an organization's online presence and potential attack vectors.
However, it's important to remember that Reverse WHOIS has limitations:
Privacy protection: WHOIS data can be privacy protected, making the information unavailable for Reverse WHOIS searches.
Accuracy: WHOIS data may only sometimes be accurate or up-to-date.
Reliance on leaked information: Some Reverse WHOIS services rely on finding domains with leaked registration information, so the data may need to be more reliable.
ThreatNG and Reverse WHOIS: A Powerful Security Duo
ThreatNG's External Attack Surface Management (EASM) and Digital Risk Protection (DRP) capabilities can work seamlessly with Reverse WHOIS, mainly through its Domain Intelligence Investigation Module, to provide a comprehensive view of your organization's digital footprint and potential security threats.
Here's how it works:
ThreatNG as the Central Hub: ThreatNG is the central platform continuously monitoring your external attack surface. Its Domain Intelligence Investigation Module offers various functionalities that complement Reverse WHOIS:
DNS Intelligence: Identifies all subdomains associated with your primary domain, providing a broader scope for investigation.
Subdomain Intelligence: Discovers additional subdomains beyond what you might find with a Reverse WHOIS search.
Certificate Intelligence: Analyzes SSL certificates associated with discovered domains, revealing connections to other organizations (potentially through shared certificates).
Exposed API Discovery & Exposed Development Environment Discovery: This process uncovers publicly accessible APIs and development environments that attackers might exploit.
VPN Discovery & Application Discovery: Identifies exposed VPN endpoints and applications that could be vulnerable.
Associated Organizations: Identifies other organizations potentially linked to yours based on shared infrastructure or certificates.
Reverse WHOIS as a Springboard: ThreatNG can leverage Reverse WHOIS by:
I use the email address or registrant name from the ThreatNG platform's WHOIS data to conduct Reverse WHOIS searches.
Feeding the discovered domains from the Reverse WHOIS search back into ThreatNG's modules for further analysis.
Benefits:
Enhanced Attack Surface Visibility: Combining ThreatNG's automated discovery with Reverse WHOIS investigations gives you a more comprehensive picture of your organization's external attack surface, including hidden assets and potential vulnerabilities.
Proactive Threat Detection: ThreatNG's continuous monitoring can identify new attack vectors, such as exposed APIs or development environments. Reverse WHOIS helps uncover unexpected connections and potential shadow IT.
Improved Threat Prioritization: ThreatNG prioritizes threats based on severity and risk, allowing you to focus on the most critical issues first.
Desired Business Outcomes:
Reduced Risk of Breaches: Proactively identifying and mitigating vulnerabilities can significantly reduce the risk of data breaches and cyberattacks.
Improved Security Posture: A comprehensive understanding of your attack surface allows you to make informed decisions about security investments and improve your overall security posture.
Enhanced Brand Protection: ThreatNG and Reverse WHOIS can help you identify and address issues like domain impersonation and trademark infringement, protecting your brand reputation.
Workflow Examples:
Proactive Scenario:
ThreatNG's DNS Intelligence identifies a new subdomain you need to know.
You use the subdomain name to conduct a Reverse WHOIS search.
The Reverse WHOIS search reveals the subdomain is associated with a cloud storage service you haven't authorized.
ThreatNG helps you investigate further, identify the source of the subdomain creation, and take appropriate action (e.g., restrict unauthorized access).
Reactive Scenario:
You receive a security alert about suspicious activity on your network.
ThreatNG helps you identify the source of the activity as originating from an unknown IP address.
You use the IP address to conduct a Reverse WHOIS search on associated domains.
The Reverse WHOIS search reveals the IP address belongs to a known malicious actor.
ThreatNG helps you investigate, identify vulnerable systems, and take steps to contain and remediate the attack.
By combining ThreatNG's EASM and DRP capabilities with Reverse WHOIS, you gain a powerful tool for managing your external attack surface, proactively identifying and mitigating security risks.
