Case Study: Palo Alto Networks achieves clearer TLD reputation analysis with WhoisXML API WHOIS data

Palo Alto Networks shows defensive registrars made up only a small fraction of newer TLDs with WhoisXML API

Researchers from Palo Alto Networks, alongside the University of California, Santa Cruz, faced the challenge of assessing TLD reputation trends and determining if high rates of non-benign classifications in newer TLDs were influenced by legitimate defensive registrations. This type of brand-protection activity is not directly visible in DNS data, making it difficult to analyze without additional registrar-level context. They turned to WhoisXML API and its WHOIS API to obtain this crucial data at scale.

WhoisXML API provided the solution by supplying the WHOIS data needed to retrieve registrar information for large domain datasets. This enabled the researchers to map domains to a curated list of registrars commonly used for defensive activity, using it as a proxy for estimation. The results confirmed that defensive registrations made up only a small fraction of newer TLDs, allowing Palo Alto Networks to validate that the observed reputation patterns were not primarily driven by this legitimate activity.

Palo Alto Networks