White Paper: Using Bulk WHOIS. Parsing for Cybercrime Analysis

Transcription

1 White Paper: Using Bulk WHOIS Parsing for Cybercrime Analysis June 2014 Whibse, Inc.

2 Overview Greek mythology tells of a battle between Hercules and the Hydra, a beast that grew two heads for every head the hero cut off. Investigating cybercrime can feel a little bit like that. Investigative analysts work hard to find and shut down illicit domain names in a criminal network, only to find the network occupying a different set of domain names a few days or weeks later. In a way, Hercules had it easy: he only had to swing his weapon at the many-headed monster. By contrast, investigators must invest significant time and effort in order to find all domain names used by the network (which can number in the thousands), analyze them to determine high-priority targets, determine the best way to take action against these illicit domain names and check to be sure enforcement has taken place. What if there was a way for analysts to instantly access accurate, up-to-the-minute WHOIS information for hundreds of domain names in a readable, sortable format? All four tasks require WHOIS information on known or suspected illicit domain names in a format that allows for analysis and comparison. Although WHOIS information is freely available to anyone with an Internet connection and knowledge of the Port 43 command, this information does not come in a format that easily lends itself to analysis. Indeed, registrars deliver WHOIS information in radically different formats. Making things worse, WHOIS information tends to arrive in a block of unparsed text which must be teased apart before any analysis can take place. For larger cybercrime networks consisting of hundreds or even thousands of domain names, this parsing process can take up more time than the analysis itself. What if there was a way for analysts to instantly access accurate, up-to-the-minute WHOIS information, parsed and organized into a readable, sortable format? A service able to standardize WHOIS information across all registrars, enabling instant comparison? Bulk WHOIS parsing engine WHIBSE delivers such a product ondemand, eliminating the need for manual WHOIS formatting. This enables analysts to immediately begin analysis without worrying about standardizing asynchronous data or parsing walls of text. 1

3 What is Bulk WHOIS Parsing? WHIBSE delivers up to 86 fields of parsed, organized WHOIS data. WHIBSE is a bulk WHOIS parsing service that takes a list of domain names and performs a WHOIS query on each domain name, yielding up-to-date, accurate results. The service then delivers this fresh information in an easy-to-read format that puts relevant data at the analyst s fingertips, ready to be sorted and inspected. To facilitate rapid analysis, WHIBSE delivers this organized and up-to-date information in a matter of minutes. The end product, available as an Excel spreadsheet, a CSV file or an HTML document, includes up to 86 individual fields of information on every domain name in the submitted list, including: Registrant name and contact information, fully parsed Fully parsed administrative, technical and billing contacts All consolidated s in the WHOIS record Registrar Reseller IP address ISP and ASN Name Server(s) Mail Server(s) SOA information Title tags and meta tags IP geolocation Analysts can sort domain names by any of these fields, examining similarities and differences between WHOIS fields for any number of domain name without any additional time spent parsing, interpreting, or decoding obtuse WHOIS results. WHIBSE does the legwork so cybercrime investigators can get right to the analysis. 2

4 Using Parsed Bulk WHOIS for Cybercrime Analysis WHOIS Data and Cybercrime Analysis Cybercrime investigation can be broken down into four steps: Network Discovery: Finding and exploiting patterns within a criminal network in order to discover all domain names affiliated with that network. Analysis and Prioritization: Determining which domain names constitute high-priority targets. Enforcement: Determining the best way to take action against illicit domain names, then neutralizing them. Confirmation of Enforcement: Checking to see whether enforcement has taken place. WHIBSE streamlines every step of this process, allowing for better network discovery, more efficient analysis and prioritization, faster enforcement and rapid confirmation. 3

5 WHIBSE and Network Discovery Investigations often start with a kernel of information: a rogue website, a dirty IP address, or a suspicious registrant. Analysts strive to cultivate that initial seed into a garden of information on the target organization, and WHOIS data can be key to a successful harvest. Registrant information, unique IP addresses, name servers, or a Google Analytics code can provide proof of association between domain names or lead to a dead end, revealing nothing. In today s world of hard deadlines, analysts often have to decide whether the possibility of learning something important outweighs the time it would take to analyze the information. Without an efficient way to quickly examine all aspects of WHOIS information for all suspicious domain names, analysts are forced to confine their investigation to a few leads, leaving some unlikely roads unexplored. Analysts can pursue every possible connection, no matter how unlikely, and determine whether it is worth further investigation. WHIBSE makes it possible for an analyst to examine every WHOIS field for every suspicious domain name appearing in the course of an investigation. Analysts can pursue every possible connection, no matter how unlikely, and quickly determine whether it is worth further investigation. For example: an IP address with a thousand domain names may be unique to a large network, or insignificant to a small one. Manually querying the registrant information for a thousand domain names would take many hours of tedious labor. Submitting that list to WHIBSE takes minutes, yielding a spreadsheet with parsed registrant information ready to be scanned and analyzed immediately. 4

6 WHIBSE Analysis and Prioritization Reports generated via bulk WHOIS parsing not only speed network development, but can help pinpoint the most important domain names within a given network. Separate the wheat from the chaff using Bulk WHOIS parsing. Many cybercrime networks engage in affiliate marketing, offering individuals not directly involved in the network a commission for sales resulting from their efforts. This can make it difficult to determine who actually operates a cybercrime network and who is merely facilitating its illicit activity. Affiliate marketing can also cloud the issue of which websites are essential to network operations, as opposed to websites that merely funnel traffic to the network. WHOIS information can help separate the essential wheat from the affiliate chaff: Often, the first registered domain names in a network belong to the network operator. WHIBSE allows analysts to quickly sort domain names in the order they were registered, allowing analysts to pay special attention to the oldest domain names. WHIBSE reports include Alexa rankings, enabling analysts to immediately single out possible anchor websites receiving the highest amount of traffic. With the included Web of Trust Rating information, analysts can quickly see which websites are already known problems, and which have yet to be identified by the public. 5

7 WHIBSE and Enforcement WHIBSE reports allow analysts to quickly identify the best possible strategy for getting illicit content offline. The Internet is a land without borders. A man in South Africa can register a domain name using a Ukrainian registrar, host his website using a Chinese hosting company, and employ a proxy service located in the Bahamas. The global nature of the online world is one of its finest qualities, yet this structure can also can complicate law enforcement efforts undertaken by national agencies. If the website in this example began to sell illegal drugs to United States citizens, cybercrime investigators would have to get creative in order to shut it down. WHIBSE reports allow analysts to quickly identify the best possible strategy for getting illicit content offline. Analysts can quickly find all the domain names using, for example, a name server that s hosted in a country where they have jurisdiction, or Google s mail server. Examining all possible avenues for enforcement with Bulk WHOIS processing allows investigators to shut down as many websites as possible, as quickly as possible. 6

8 WHIBSE and Confirming Enforcement Determine at a glance whether enforcement has occurred. Bulk WHOIS processing also makes it easy to check whether enforcement has taken place. Rather than manually checking WHOIS data to determine enforcement status, WHIBSE s up-tothe-minute reports make it possible to check the status of hundreds of websites in minutes. The Online Status field allows analysts to determine at a glance whether a given domain name is offline or not, and analysts can sort WHIBSE reports by registrant information to immediately determine whether a website has been suspended or remains under criminal control. 7

9 Conclusion Visit us today to see what WHIBSE can do for you Bulk WHOIS parsing has the ability to make every aspect of cybercrime investigation more efficient. WHIBSE reports allow analysts to quickly identify patterns within WHOIS information they can then exploit to discover every domain name within a criminal network. Analysts can quickly determine which websites receive the most traffic or have garnered the most negative attention from monitoring agencies. WHIBSE streamlines the enforcement process by allowing agents to determine which components of a cybercrime network fall within relevant jurisdiction. And analysts can quickly check to see whether enforcement has occurred by periodically running the relevant domain names through WHIBSE s bulk processor. About Whibse For cybercrime investigators, time is more than money. Time saved can mean retirement funds saved from scammers, lives saved from counterfeit medications or illegal drugs, or identities saved from phishing scams. By bulk-parsing WHOIS records, the weeks and months that would otherwise be required to retrieve and analyze hundreds or thousands of WHOIS records shrink to minutes. Whibse is a service that provides bulk WHOIS (domain name registration records) lookup and parsing for brand protection and Internet research purposes. With over 1.2 million domain names parsed so far, WHIBSE can parse WHOIS records for all major gtlds and registrars. Learn more at 8