WHOIS

No, much deeper.

PCPL Alexa shows it pulling A records, MX records, NS records, and CNAME records alongside full WHOIS database lookups and TCP port scanning.

So for those listening who might not spend their days mapping network architecture, let's break down exactly what those tools actually reveal to an analyst.

Please do.

Naturally.

How do the analysts use Osiris to proactively neutralize this threat before the client ever types World Cup tickets into their browser?

They utilize the WHOIS lookup and DNS intelligence tools we discussed during the digital footprinting phase, but they apply them offensively.

Okay.

It's no big secret.

Uh, they, uh, whoever created this website, um, was not super mindful of operational security because when I looked at its Whois information, which is sort of information that tells you about-- tells you who registered a website, um, it showed that the registrant's country was in China.

Like, all, uh, most of the information was redacted, but you could see that the registrant was based in China.

And the consulting firm said that it was dual headquartered in Colorado, interestingly, uh, and Singapore.

So I'm going to go with Google and or an advertising angle.

Well, you go to whois.com or whois.whatever it is, whois.info, and it says data redacted under registrant contact, but it does have a phone number.

Did you call the phone number? I didn't call the phone number.

I don't want to be put on a list.

And one of the problems that I really wanted to target was what's accessibility to this methodology look like? Like what is practical applications for someone that doesn't have a CTI team, someone that doesn't have a data lake of logs, that doesn't necessarily even know about all the technical information to do a reverse engineering report to be able to tell you the traversal of the kill chain and where they probably did what.

For someone who doesn't have the resources to do domain hunting, to be able to look at the old expired users using Whois and then being able to track them over time and having all these pivot tables and Excel files.

There's a lot of random skills that we have to collect just to answer one question.

Absolutely.

[laughs]

They can't do what I do with .agent on the .agent ICANN because they need to know the Whois information to do it, so they actually can't do the same thing I can do.

Yeah.

You can register anonymously a .agent on Halas Domains with the Handshake domain on your terminal, but you can't...

afflicted!'

Whoís there, eh? FRIAR LAWRENCE.

Pray God he be not angry.

FRIAR

LAWRENCE.

Whoís there, I say? How dare you thrust yourselves into my private meditations? Who am I? Ah! FRIAR LAWRENCE.

A gracious king, that pardons all offences, malice neíer meant.

Our breach of duty this way is business of estate, in which we come to know your royal pleasure.