Summary
This technical report presents an in-depth analysis of the Genesis Market's infrastructure through DNS investigations. The report outlines the findings of the WhoisXML API research team, which aimed to determine whether the Genesis Market, operational since 2017 and recently taken down by law enforcement, is truly defunct. The analysis began with a list of twelve email addresses identified as indicators of compromise (IoCs), leading to the discovery of 28 email-connected domains, five unique IP addresses, and 2,417 string-connected domains. The report details the examination of these domains, including the identification of malicious domains and the registrars associated with them. It also highlights the similarities found between the IoCs and connected domains, such as shared registrars and creation years. The report concludes with a cautionary note on threat detection, emphasizing the need for further investigation into identified threats. The appendix includes sample artifacts and IoCs for reference.
