<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-whois-analysis
description: >-
  Perform WHOIS lookups and analysis to identify domain registrants, registrars,
  creation/expiration dates, nameservers, and organizational relationships
  for intelligence gathering.
domain: cybersecurity
subdomain: osint-recon
tags:
  - whois
  - domain-registration
  - registrant
  - infrastructure
  - attribution
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  whois, python-whois, jwhois, RDAP, SecurityTrails API,
  DomainTools API.
metadata:
  mitre-attack:
    - "T1596.002"  # Search Open Technical Databases: WHOIS/DNS
    - "T1591"      # Gather Victim Org Information
---

# Performing WHOIS Analysis

## Overview

WHOIS analysis queries domain registration databases to extract registrant
information, nameservers, registration dates, and registrar details. This
intelligence supports attribution, infrastructure mapping, and identifying
related domains through shared registration data. RDAP (Registration Data
Access Protocol) is the modern successor providing structured JSON responses.

## Prerequisites

- whois CLI utility (pre-installed on most Linux/macOS)
- Python 3.10+ with `python-whois`, `requests`
- API keys: DomainTools, SecurityTrails (optional for bulk/historical)

```bash
pip install python-whois requests
```

## Quick Reference

| Task | Command |
|------|---------|
| Domain WHOIS | `whois example.com` |
| IP WHOIS | `whois 1.2.3.4` |
| ASN lookup | `whois -h whois.radb.net AS15169` |
| RDAP query | `curl -s "https://rdap.verisign.com/com/v1/domain/example.com"` |
| Registrar info | `whois example.com \| grep -i registrar` |
| Nameservers | `whois example.com \| grep -i "name server"` |
| Creation date | `whois example.com \| grep -i "creation"` |

## Workflow

### Step 1: Basic WHOIS Lookup

```bash
# Domain registration data
whois example.com

# IP address — reveals ASN, netblock, org
whois 1.2.3.4

# ASN information
whois -h whois.radb.net AS15169
```

### Step 2: RDAP Structured Query

```bash
# RDAP returns structured JSON
curl -s "https://rdap.verisign.com/com/v1/domain/example.com" | jq '{
  name: .ldhName,
  status: .status,
  registrar: .entities[0].vcardArray,
  nameservers: [.nameservers[].ldhName],
  events: [.events[] | {action: .eventAction, date: .eventDate}]
}'
```

### Step 3: Reverse WHOIS — Find Related Domains

```bash
# SecurityTrails — domains by registrant
curl -s -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/domain/example.com/associated" \
  | jq '.records[].hostname'

# DomainTools reverse WHOIS (paid API)
curl -s "https://api.domaintools.com/v1/reverse-whois/?terms=registrant@example.com&api_username=$DT_USER&api_key=$DT_KEY"
```

### Step 4: Historical WHOIS

```bash
# SecurityTrails WHOIS history
curl -s -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/history/example.com/whois"

# Track registrant changes, nameserver migrations, privacy toggles
```

### Step 5: Bulk Analysis

```bash
# Enumerate shared infrastructure
for domain in $(cat domains.txt); do
  echo "=== $domain ===" >> whois_bulk.txt
  whois "$domain" | grep -iE "registrant|nameserver|creation|registrar" >> whois_bulk.txt
done
```

## Detection Opportunities

- WHOIS queries are logged by registrars but rarely alerted on
- Bulk WHOIS queries may trigger rate limiting on WHOIS servers
- RDAP queries leave standard HTTP access logs

## Verification

- [ ] Registrant, registrar, and nameserver data extracted
- [ ] Registration dates (creation, expiration, updated) recorded
- [ ] Related domains identified via reverse WHOIS
- [ ] Historical WHOIS changes tracked for attribution
- [ ] WHOIS privacy status documented
- [ ] ASN and netblock information for IP targets recorded

## References

- [ICANN WHOIS](https://lookup.icann.org/)
- [RDAP Specification](https://www.rfc-editor.org/rfc/rfc9083)
- [SecurityTrails WHOIS](https://securitytrails.com/corp/apidocs)
- [DomainTools](https://www.domaintools.com/resources/api-documentation)

---
v1.0 | Validated: 2026-03-17
