WHOIS Domain Lookup via Web Service

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects HTTP requests made to 'whois.domaintools.com', indicating a WHOIS domain lookup activity via a web service. It triggers an alert if five such requests are observed from the same source within 60 seconds. This activity is often associated with reconnaissance.