WhoisXML API @ Black Hat USA 2026

Attacking the World's Firewalls & The Pyongyang Piggyback  

🚀 This session follows two investigations: Internet-wide reconnaissance against enterprise firewalls, and North Korea's external Internet footprint, with Alex Ronquillo

Using observations from the WXA Internet Abuse Signal Collective (IASC), we'll show how global NetFlow sampling across major IXPs captured FortiBleed reconnaissance without relying on sinkholes or honeypots. You'll see:

• Maps of FortiBleed reconnaissance as it crossed major Internet exchange points
• NetFlow timelines showing attacker infrastructure expanding, shifting, and disappearing
• Victimology cuts by ASN, country, industry, and exposed service
• Campaign graphs linking scanners, targets, and reused infrastructure
• Pivots from single scanner IPs to recurring attacker clusters
• Device locations that contradict GeoIP, BGP, and WHOIS
• A reconstruction of North Korea's Internet beyond its borders

From global firewall scanning to Pyongyang's piggybacked connectivity, this talk turns Internet abuse signals into evidence of attacker infrastructure, victim exposure, and hidden physical networks.

WhoisXML API delivers the domain, DNS, and IP intelligence trusted by cybersecurity teams building next-generation products. With over 15 years of experience and recognition from Inc. 5000 and the Financial Times, we support leading security companies, threat intel teams, and national security agencies worldwide. Our data powers detection, enrichment, attribution, and prevention at scale. We deliver much more: