Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
2
Categories
1
1
1
Platforms
1
1
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
IDS Classtypes
1
IDS Protocols
1
Detects use of WHOIS web services for domain property enumeration
WHOIS Database API Bulk Query
Suricata
This rule detects HTTP requests to known WHOIS database API services (whoisxmlapi.com, whoisfreaks.com, whoapi.com). Such activity could indicate an attempt to perform bulk reconnaissance on domains or IP addresses, potentially for malicious purposes like phishing, infrastructure mapping, or identifying targets.