Table: whois_domain - Query Whois Domains using SQL

Whois is a protocol that is used to query databases that store the registered users or assignees of an Internet resource, such as a domain name or an IP address block. It provides information related to the registration and ownership of a domain name. This includes details about the registrant, administrative, billing and technical contacts.

Table Usage Guide

The whois_domain table provides insights into domain names within the Whois protocol. As a security analyst, explore domain-specific details through this table, including registration, ownership, and associated metadata. Utilize it to uncover information about domains, such as their registrant details, administrative contacts, and the status of the domain.

Important Notes

• It's not practical to list all domains in the world, so this table requires a domain qualifier to be passed in the where or join clause for all queries.

Examples

Basic whois info

select
  domain,
  expiration_date
from
  whois_domain
where
  domain = 'steampipe.io';

select
  domain,
  expiration_date
from
  whois_domain
where
  domain = 'steampipe.io';

Days until expiration

select
  domain,
  expiration_date,
  date_part('day', expiration_date - current_date) as days_until_expiration
from
  whois_domain
where
  domain = 'steampipe.io';

select
  domain,
  expiration_date,
  julianday(expiration_date) - julianday(date('now')) as days_until_expiration
from
  whois_domain
where
  domain = 'steampipe.io';

Get name server information

select
  domain,
  name_servers
from
  whois_domain
where
  domain = 'steampipe.io';

select
  domain,
  name_servers
from
  whois_domain
where
  domain = 'steampipe.io';

Check domain status codes

Commonly used protections:

select
  domain,
  client_delete_prohibited,
  client_transfer_prohibited,
  client_update_prohibited,
  server_delete_prohibited,
  server_transfer_prohibited,
  server_update_prohibited
from
  whois_domain
where
  domain = 'steampipe.io';

select
  domain,
  client_delete_prohibited,
  client_transfer_prohibited,
  client_update_prohibited,
  server_delete_prohibited,
  server_transfer_prohibited,
  server_update_prohibited
from
  whois_domain
where
  domain = 'steampipe.io';

Check for any EPP status code:

select
  domain,
  status,
  status ? 'pendingtransfer' as pending_transfer
from
  whois_domain
where
  domain = 'steampipe.io';

select
  domain,
  status,
  json_extract(status, '$.pendingtransfer') as pending_transfer
from
  whois_domain
where
  domain = 'steampipe.io';

Contact information

select
  domain,
  jsonb_pretty(admin) as admin,
  jsonb_pretty(billing) as billing,
  jsonb_pretty(registrant) as registrant,
  jsonb_pretty(technical) as technical
from
  whois_domain
where
  domain = 'steampipe.io';

select
  domain,
  admin,
  billing,
  registrant,
  technical
from
  whois_domain
where
  domain = 'steampipe.io';

Registrar managing the domain

select
  domain,
  registrar ->> 'name' as registrar
from
  whois_domain
where
  domain = 'steampipe.io';

select
  domain,
  json_extract(registrar, '$.name') as registrar
from
  whois_domain
where
  domain = 'steampipe.io';

Working with multiple domains

select
  domain,
  expiration_date
from
  whois_domain
where
  domain in (
    'github.com',
    'google.com',
    'steampipe.io',
    'yahoo.com'
  );

select
  domain,
  expiration_date
from
  whois_domain
where
  domain in (
    'github.com',
    'google.com',
    'steampipe.io',
    'yahoo.com'
  );

Implementation notes

• Automatically retries with backoff. WHOIS servers are fussy with throttling.
• May return partial results, some WHOIS servers return domain info but throttle / skip contact information.

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- whois

You can pass the configuration to the command with the --config argument:

steampipe_export_whois --config '<your_config>' whois_domain