Case Study: The MITRE Corporation advances cybersecurity analysis with WhoisXML API

An interactive pivotable tool for analysts and researchers to work with Whois data

The MITRE Corporation, a not-for-profit organization focused on cybersecurity and other critical security challenges, needed a better way for researchers and analysts to work with Whois data. Using WhoisXML API data, they built an interactive front-end called WhoDat to support pivoting and analysis of current and historic domain information.

WhoisXML API’s data helped power PyDAT, the Python-based version of WhoDat, which integrates Whois data with IP resolutions and passive DNS and offers a scriptable API for JSON search results. The solution gave MITRE a flexible, extensible, open-source tool for WHOIS pivoting to investigate spear-phishing link domains and adversary infrastructure, improving intelligence gathering and enabling broader community use.

The MITRE Corporation