Product Blog

It can be said without a doubt that businesses of the 21st century are all geared towards the internet. With rapid advancements in digital technology and the exponential growth of the online ecosystem, it hardly comes as a surprise that businesses have to maintain a considerable presence on the web in order to cater to the needs of the online population. Apart from this, the rapid proliferation of the internet into even the most remote corners of the world has opened up new business avenues and markets that were previously difficult to access, or even altogether unavailable for business. This has naturally incentivized businesses to move online.

Threat hunting involves proactively looking for signs of attack within your network, by means of a set of indicators of compromise (IoCs). These IoCs are compared with network access logs to pinpoint if any of the users are unauthorized. More specifically, threat hunters can use Domain Name System (DNS) and firewall logs to list all IP addresses and domains connected or trying to gain access to the network.

In this series of blogs, we investigate the background of individual spam mail cases. By using tools provided by WhoisXML API: the domain reputation, WHOIS, and e-mail verification APIs, we unfold the background of these messages. This approach also reveals interesting details about the behavior and habits of spammers and cybercriminals using e-mail, typically for phishing.

In spite of all the effort e-mail providers put in worldwide, every user receives a tremendous amount of unwanted and malicious mail to any e-mail account. It is indeed annoying, but let’s look on the bright side: we can use these examples to demonstrate how useful the APIs by WhoisXML API can be in the battle against unwanted spam e-mails. In today’s example we’ll be using the e-mail verification API, the domain reputation API and the WHOIS API to analyze a spam email message which was not caught by a well-configured open-source spam filtering system.