WHOIS Database API Bulk Query

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects HTTP requests to known WHOIS database API services (whoisxmlapi.com, whoisfreaks.com, whoapi.com). Such activity could indicate an attempt to perform bulk reconnaissance on domains or IP addresses, potentially for malicious purposes like phishing, infrastructure mapping, or identifying targets.