<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
  xmlns:dc="http://purl.org/dc/elements/1.1/"
  xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
  xmlns:admin="http://webns.net/mvcb/"
  xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
  xmlns:content="http://purl.org/rss/1.0/modules/content/">

Third segment: whois
  
  <channel>

  <title><![CDATA[CircleID]]></title>
  <link>https://circleid.com/topics/whois</link>
  <description>CircleID - Whois</description>
  <dc:language>en</dc:language>
  <dc:rights>Copyright 2026, unless where otherwise noted.</dc:rights>
  <dc:date>2026-09-09T19:55:00+00:00</dc:date>

  
    <item>
      <title><![CDATA[DNS Spotlight: 2026&#8217;s 5 Most Notorious Ransomware]]></title>
      <link>https://circleid.com/posts/dns&#45;spotlight&#45;2026s&#45;5&#45;most&#45;notorious&#45;ransomware</link>
      <guid isPermaLink="true">https://circleid.com/posts/dns&#45;spotlight&#45;2026s&#45;5&#45;most&#45;notorious&#45;ransomware</guid>

      <description><![CDATA[DNS analysis of 84 network indicators tied to LockBit, Cl0p, Akira, Medusa, and Qilin uncovered thousands of connected domains and IP addresses, including additional artifacts already identified as malicious.]]></description>
      <dc:date>2026-09-08T07:59:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[Thirty-Five Years Later, Moscow Comes Looking for the Soviet Union&#8217;s Domain]]></title>
      <link>https://circleid.com/posts/thirty&#45;five&#45;years&#45;later&#45;moscow&#45;comes&#45;looking&#45;for&#45;the&#45;soviet&#45;unions&#45;domain</link>
      <guid isPermaLink="true">https://circleid.com/posts/thirty&#45;five&#45;years&#45;later&#45;moscow&#45;comes&#45;looking&#45;for&#45;the&#45;soviet&#45;unions&#45;domain</guid>

      <description><![CDATA[Russia is imposing state identity verification on .su, the Soviet Union's surviving domain, as researchers uncover criminal infrastructure across the namespace and ICANN pursues a retirement process that could eventually remove it from the global root.]]></description>
      <dc:date>2026-09-01T08:35:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[A DNS Infrastructure Analysis of a Microsoft 365 Device Code Phishing Campaign]]></title>
      <link>https://circleid.com/posts/a&#45;dns&#45;infrastructure&#45;analysis&#45;of&#45;a&#45;microsoft&#45;365&#45;device&#45;code&#45;phishing&#45;campaign</link>
      <guid isPermaLink="true">https://circleid.com/posts/a&#45;dns&#45;infrastructure&#45;analysis&#45;of&#45;a&#45;microsoft&#45;365&#45;device&#45;code&#45;phishing&#45;campaign</guid>

      <description><![CDATA[A DNS investigation into a Microsoft 365 device code phishing campaign uncovered coordinated, disposable infrastructure, including 290 indicators of compromise, 87 malicious IP addresses and hundreds of connected domains, suggesting the operation remains active.]]></description>
      <dc:date>2026-08-28T11:59:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[5 of the Biggest Cyber Attacks in 2026 So Far: DNS Deep Dive]]></title>
      <link>https://circleid.com/posts/5&#45;of&#45;the&#45;biggest&#45;cyber&#45;attacks&#45;in&#45;2026&#45;so&#45;far&#45;dns&#45;deep&#45;dive</link>
      <guid isPermaLink="true">https://circleid.com/posts/5&#45;of&#45;the&#45;biggest&#45;cyber&#45;attacks&#45;in&#45;2026&#45;so&#45;far&#45;dns&#45;deep&#45;dive</guid>

      <description><![CDATA[A DNS deep dive into five major cyber attacks of 2026 uncovers infrastructure linked to Cisco, Ivanti, Stryker and ShinyHunters incidents, revealing hundreds of connected domains and IP addresses that could sharpen threat detection efforts.]]></description>
      <dc:date>2026-08-24T11:43:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[Beyond Protocol and Policy: Why Project Jake is Reshaping the Architecture of Internet Trust]]></title>
      <link>https://circleid.com/posts/beyond&#45;protocol&#45;and&#45;policy&#45;why&#45;project&#45;jake&#45;is&#45;reshaping&#45;the&#45;architecture&#45;of&#45;internet&#45;trust</link>
      <guid isPermaLink="true">https://circleid.com/posts/beyond&#45;protocol&#45;and&#45;policy&#45;why&#45;project&#45;jake&#45;is&#45;reshaping&#45;the&#45;architecture&#45;of&#45;internet&#45;trust</guid>

      <description><![CDATA[Project Jake aims to bridge the divide between internet protocols and policy, offering registries, law enforcement and rights holders a decentralised framework for accessing domain-registration data securely while navigating privacy laws and institutional gridlock.]]></description>
      <dc:date>2026-08-24T10:49:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[Massive Photo ZIP Campaign Targets Booking.com Partner and Other Hotels across Japan and Europe]]></title>
      <link>https://circleid.com/posts/massive&#45;photo&#45;zip&#45;campaign&#45;targets&#45;booking&#45;dot&#45;com&#45;partner&#45;and&#45;other&#45;hotels</link>
      <guid isPermaLink="true">https://circleid.com/posts/massive&#45;photo&#45;zip&#45;campaign&#45;targets&#45;booking&#45;dot&#45;com&#45;partner&#45;and&#45;other&#45;hotels</guid>

      <description><![CDATA[A sprawling phishing campaign targeting hotels in Japan and Europe used deceptive photo ZIP files and legitimate web services to establish persistent access, while researchers uncovered thousands of potentially connected infrastructure artifacts and victim IP addresses.]]></description>
      <dc:date>2026-08-18T11:18:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[Global Domain Activity Trends Seen in Q2 2026]]></title>
      <link>https://circleid.com/posts/global&#45;domain&#45;activity&#45;trends&#45;seen&#45;in&#45;q2&#45;2026</link>
      <guid isPermaLink="true">https://circleid.com/posts/global&#45;domain&#45;activity&#45;trends&#45;seen&#45;in&#45;q2&#45;2026</guid>

      <description><![CDATA[WhoisXML API's Q2 2026 analysis reveals rising domain registrations, shifting TLD rankings, growing DNS infrastructure concentration, and evolving malicious domain activity, based on billions of DNS records and millions of newly registered and confirmed malicious domains.]]></description>
      <dc:date>2026-08-13T07:43:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[APT37 Strikes Again, This Time with NarwhalRAT]]></title>
      <link>https://circleid.com/posts/apt37&#45;strikes&#45;again&#45;this&#45;time&#45;with&#45;narwhalrat</link>
      <guid isPermaLink="true">https://circleid.com/posts/apt37&#45;strikes&#45;again&#45;this&#45;time&#45;with&#45;narwhalrat</guid>

      <description><![CDATA[North Korea's APT37 has launched a new NarwhalRAT campaign using spearphishing emails and malicious LNK files to deploy data-stealing malware. Researchers also uncovered infrastructure links and fresh indicators that expand the group's known operational footprint.]]></description>
      <dc:date>2026-08-07T08:38:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[A DNS Investigation of LenAI&#8217;s ErrTraffic ClickFix Distribution Network]]></title>
      <link>https://circleid.com/posts/a&#45;dns&#45;investigation&#45;of&#45;lenais&#45;errtraffic&#45;clickfix&#45;distribution&#45;network</link>
      <guid isPermaLink="true">https://circleid.com/posts/a&#45;dns&#45;investigation&#45;of&#45;lenais&#45;errtraffic&#45;clickfix&#45;distribution&#45;network</guid>

      <description><![CDATA[An analysis of LenAI's ErrTraffic ClickFix infrastructure uncovered new DNS links, exposing malicious domains, IPs, typosquatting clusters, and email connections that broaden threat visibility and support stronger detection and incident response through expanded network intelligence.]]></description>
      <dc:date>2026-07-31T08:39:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[Inside a TDS-Powered ClickFix Malware Ecosystem: A DNS Deep Dive]]></title>
      <link>https://circleid.com/posts/inside&#45;a&#45;tds&#45;powered&#45;clickfix&#45;malware&#45;ecosystem&#45;a&#45;dns&#45;deep&#45;dive</link>
      <guid isPermaLink="true">https://circleid.com/posts/inside&#45;a&#45;tds&#45;powered&#45;clickfix&#45;malware&#45;ecosystem&#45;a&#45;dns&#45;deep&#45;dive</guid>

      <description><![CDATA[DNS analysis of a malware distribution ecosystem uncovered thousands of linked artifacts, exposing typosquatting, malicious infrastructure and victim connections that broaden detection opportunities beyond Check Point Research's original indicators through expanded DNS intelligence correlation efforts.]]></description>
      <dc:date>2026-07-27T12:51:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[DNS Investigation: Threat Actor TA4922 Goes Global]]></title>
      <link>https://circleid.com/posts/dns&#45;investigation&#45;threat&#45;actor&#45;ta4922&#45;goes&#45;global</link>
      <guid isPermaLink="true">https://circleid.com/posts/dns&#45;investigation&#45;threat&#45;actor&#45;ta4922&#45;goes&#45;global</guid>

      <description><![CDATA[TA4922 is expanding beyond nearby targets, deploying a fast-changing malware arsenal across Europe and Africa. A DNS investigation uncovered thousands of connected domains, dozens of malicious assets and signs of compromised victim infrastructure worldwide today.]]></description>
      <dc:date>2026-07-17T08:56:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[Under the DNS Hood of an Ongoing Legacy MSHTA Tool Attack]]></title>
      <link>https://circleid.com/posts/under&#45;the&#45;dns&#45;hood&#45;of&#45;an&#45;ongoing&#45;legacy&#45;mshta&#45;tool&#45;attack</link>
      <guid isPermaLink="true">https://circleid.com/posts/under&#45;the&#45;dns&#45;hood&#45;of&#45;an&#45;ongoing&#45;legacy&#45;mshta&#45;tool&#45;attack</guid>

      <description><![CDATA[A DNS analysis of infrastructure behind ongoing MSHTA abuse uncovered malicious registrations, typosquatting clusters, victim activity, and hundreds of linked indicators, revealing how legacy Windows tooling continues enabling modern malware campaigns through interconnected DNS intelligence.]]></description>
      <dc:date>2026-07-10T09:16:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[Public Data Is Not Public Infrastructure]]></title>
      <link>https://circleid.com/posts/public&#45;data&#45;is&#45;not&#45;public&#45;infrastructure</link>
      <guid isPermaLink="true">https://circleid.com/posts/public&#45;data&#45;is&#45;not&#45;public&#45;infrastructure</guid>

      <description><![CDATA[Building infrastructure for public trademark data revealed a familiar lesson from Internet protocols: publishing information is only the beginning. The real challenge is engineering resilient systems that withstand inconsistent formats, unreliable sources, and organisational complexity.]]></description>
      <dc:date>2026-07-10T08:39:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[macOS ClickFix Campaign Delivers AMOS and Other Infostealers: A DNS Deep Dive]]></title>
      <link>https://circleid.com/posts/macos&#45;clickfix&#45;campaign&#45;delivers&#45;amos&#45;and&#45;other&#45;infostealers&#45;a&#45;dns&#45;deep&#45;dive</link>
      <guid isPermaLink="true">https://circleid.com/posts/macos&#45;clickfix&#45;campaign&#45;delivers&#45;amos&#45;and&#45;other&#45;infostealers&#45;a&#45;dns&#45;deep&#45;dive</guid>

      <description><![CDATA[A DNS deep dive into Microsoft's macOS ClickFix campaign uncovered victim infrastructure, typosquatting clusters, malicious registrations, and hundreds of linked indicators, exposing a broader infostealer ecosystem beyond the original 140 network IoCs identified by Microsoft.]]></description>
      <dc:date>2026-07-06T08:58:00-07:00</dc:date>
    </item>
  
    <item>
      <title><![CDATA[DNS Deep Dive: TA416 European Government Espionage Campaigns]]></title>
      <link>https://circleid.com/posts/dns&#45;deep&#45;dive&#45;ta416&#45;european&#45;government&#45;espionage&#45;campaigns</link>
      <guid isPermaLink="true">https://circleid.com/posts/dns&#45;deep&#45;dive&#45;ta416&#45;european&#45;government&#45;espionage&#45;campaigns</guid>

      <description><![CDATA[An extensive DNS analysis of TA416's renewed European espionage campaign uncovered malicious infrastructure, typosquatting clusters, historical network activity, and thousands of connected artifacts that expand defenders' visibility beyond Proofpoint's original indicators for proactive threat hunting.]]></description>
      <dc:date>2026-06-29T13:10:00-07:00</dc:date>
    </item>
  

  </channel>
  

</rss>