Bypassing WHOIS Rate Limiting and Tracking Fresh Enterprise Domains

This conference talk from Recon Village at DEF CON 32 explores how to overcome WHOIS rate limiting and track newly registered enterprise domains at scale. Learn from Willis Vandevanter (@0xrst) about the whoiswatcher tool that enables processing 1-1.5 million WHOIS queries daily through serverless cloud deployments and IPv6 proxying methods handling up to 200,000 queries per day with minimal infrastructure. Discover techniques for building comprehensive WHOIS datasets, reviewing historic WHOIS records, and implementing alerting systems for new enterprise domains—valuable for reconnaissance, threat intelligence, and security monitoring. The 18-minute presentation includes a live demonstration of whoiswatcher in action, showcasing its practical applications for enterprise security monitoring, attack surface discovery, and threat intelligence gathering.