Cybersecurity

DNS Analysis: AI-Powered RatHat Smishing Campaign

An investigation into RatHat Android malware uncovered 33 network indicators of compromise, 240 client IP addresses communicating with suspicious domains and thousands of connected domains, revealing infrastructure associated with a smishing campaign.

DNS Spotlight: BigBear 2.0 PhaaS Targets Span 40+ Countries

An investigation into the BigBear 2.0 phishing operation examines 38 network indicators of compromise, identifying 81 potential victim IP addresses and more than 1,000 related domains through DNS, WHOIS and threat intelligence analysis.

New Attack Type: ASCII Smuggling-AI Prompt Injection-Phishing Studied

A phishing campaign used invisible Unicode characters to evade email filters. WhoisXML API analyzed its domain and IP indicators, uncovering 165 connected artifacts, 158 undetected by engines listed on VirusTotal.

Why Brand Protection Must Extend Across Social Media, Marketplaces and Domains

Brand impersonation across social media, marketplaces and lookalike domains creates interconnected cybersecurity risks. Coordinated monitoring, AI-assisted detection, human validation and enforcement can help organizations identify fraudulent campaigns and protect customers.

ams OSRAM Case Study Details Practical Deployment of SPF, DKIM and DMARC

An eco case study details how ams OSRAM approached SPF, DKIM and DMARC deployment to protect corporate domains, improve email deliverability and gain visibility into legitimate and illegitimate sending sources.

DNS Spotlight: Silver Fox Strikes Anew with a Fake Installer Campaign

A Silver Fox-style fake installer campaign used deceptive software download sites to distribute malware, while DNS and WHOIS analysis uncovered typosquatting domains, potential victim traffic and more than 1,500 campaign-connected artifacts.

Jewelbug Targets the Middle East and Asia via Cyber Espionage and Crypto Fraud Campaigns

Researchers linked Jewelbug's cyber espionage and crypto fraud operations to shared infrastructure, while DNS analysis uncovered thousands of connected domains, hundreds of potential victim IP addresses and additional malicious artifacts.

3 Russian Threat Groups Target Persons of Interest

A DNS investigation into indicators linked to three Russian threat groups uncovered potentially victim-owned IP addresses and thousands of connected domains, including infrastructure already associated with malicious activity.

DNS Footprinting: SourTrade Distributes Unfinished Malware through Malvertising

DNS analysis of 96 SourTrade domains uncovered hundreds of connected domains and IP addresses, many flagged as malicious, while identifying indicators that appeared months before researchers formally linked them to the malvertising campaign.

DNS Spotlight: 2026’s 5 Most Notorious Ransomware

DNS analysis of 84 network indicators tied to LockBit, Cl0p, Akira, Medusa, and Qilin uncovered thousands of connected domains and IP addresses, including additional artifacts already identified as malicious.