Case Study: Lighthouse Reports exposes years-long cyber surveillance operations with WhoisXML API

WHOIS Data Aids Lighthouse Reports Shed Light on Years-Long Surveillance Operations

Lighthouse Reports is a nonprofit investigative news organization that uses OSINT, social media listening, and data mining to investigate complex issues. In its “Revealing Europe’s NSO” project, it needed to identify the scope and timeline of a suspected cyber surveillance operation and understand when the malicious domains involved were registered. WhoisXML API provided WHOIS data to enrich a list of suspicious fake domains tied to the investigation.

Using WhoisXML API’s WHOIS and domain intelligence, Lighthouse Reports determined that some of the domains used by the threat actors had been registered as early as 2015, while others were acquired in March 2022. This helped reveal years of potential hacking activity behind the surveillance campaign. WhoisXML API’s data supported the broader investigation and contributed to exposing the operation’s reach and impact across Europe.

Lighthouse Reports

Jonathan Zhang

Chief Executive Officer