Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
2
Categories
1
1
1
Platforms
1
1
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,193
15,767
12,685
8,498
6,307
IDS Classtypes
1
IDS Protocols
1
Detects use of WHOIS web services for domain property enumeration
WHOIS Database API Bulk Query
Suricata
This rule detects HTTP requests to known WHOIS database API services (whoisxmlapi.com, whoisfreaks.com, whoapi.com). Such activity could indicate an attempt to perform bulk reconnaissance on domains or IP addresses, potentially for malicious purposes like phishing, infrastructure mapping, or identifying targets.