---
name: avizmarlon/dns-and-whois-tools
source: https://app.decimal.ai/s/avizmarlon-dns-and-whois-tools@1/SKILL.md
source_sha256: 5299316f672e
---

# DNS & WHOIS Tools

Investigation toolkit for DNS, WHOIS, IP reputation, and passive-DNS work. Applies to any domain or IP across public internet domains.

## DNS lookup — preferred order

1. **`wsl dig`** — fullest output, supports `+short`, `+noall +answer`, `ANY`, `AXFR`, etc.
2. **Google DNS API** — `curl -s "https://dns.google/resolve?name=DOMAIN&type=A"` — works from any shell, returns JSON.
3. **`nslookup`** — works but some local resolvers may return "No response from server". Use only when 1 and 2 are unavailable.

## Current DNS records

```bash
# A / NS / MX / CNAME / TXT via Google DNS-over-HTTPS
curl -s "https://dns.google/resolve?name=DOMAIN&type=A|NS|MX|CNAME|TXT"

# Indexed subdomains (HackerTarget)
curl -s "https://api.hackertarget.com/hostsearch/?q=DOMAIN"
```

## Historical / passive DNS

Use these when "what nameservers did this domain use before migrating?" or "what DNS records existed historically?" matters. They reveal records that no longer resolve.

- **crt.sh** (Certificate Transparency): `curl -s "https://crt.sh/?q=%.DOMAIN&output=json"` — reveals subdomains that ever had SSL issued (indirect evidence they existed).
- **SecurityTrails** — `https://securitytrails.com/domain/DOMAIN/dns` (WebFetch; may require account).
- **WhoisFreaks** — `https://whoisfreaks.com/tools/dns/history/lookup/DOMAIN` (WebFetch).
- **DNSHistory.org** — `https://dnshistory.org/dns-records/DOMAIN` (WebFetch).
- **ViewDNS.info** — `https://viewdns.info/history/?domain=DOMAIN` (WebFetch).

Priority order for historical nameservers: SecurityTrails (preferred, comprehensive history) → WhoisFreaks → ViewDNS.info → DNS provider customer support.

## WHOIS — domain ownership and registrar information

- **who.is** — `https://who.is/whois/DOMAIN` (WebFetch).
- **ICANN Lookup** — `https://lookup.icann.org/en/lookup?name=DOMAIN` (WebFetch).
- **`wsl whois DOMAIN`** for shells with `whois` available.

**Note:** some ccTLDs (`.in`, `.de`, `.uk`, etc.) do not expose public WHOIS for the registrant due to regional privacy regulations.

## IP reputation

### ipinfo.io (organization, ASN, hostname, geolocation)

```bash
curl -s "https://ipinfo.io/IP/json"
```

Returns: organization name, ASN, reverse hostname, country, city, ISP.

### AbuseIPDB (abuse score for blacklist / nullroute decisions)

The API key should be stored in a secure vault (e.g., Bitwarden, environment variable, credential manager). Reference it as an environment variable `ABUSEIPDB_API_KEY` — never hardcode it.

```bash
curl -G https://api.abuseipdb.com/api/v2/check \
  --data-urlencode "ipAddress=IP" \
  -H "Key: $ABUSEIPDB_API_KEY" \
  -H "Accept: application/json"
```

If `ABUSEIPDB_API_KEY` is not set in the current shell, retrieve it securely and export it for the session (`export ABUSEIPDB_API_KEY=...` on Bash / `$env:ABUSEIPDB_API_KEY=...` on PowerShell) — do not print the value to stdout or logs.

## Registrar ≠ hosting provider — critical rule

**Never assume the registrar (WHOIS registrant) is also the hosting provider.** They are independent business relationships: a domain can be registered at GoDaddy but hosted at Linode, or registered at Namecheap and hosted at AWS.

To find **historical nameservers** (e.g., "what was the NS before the domain was migrated?"):

- Start with SecurityTrails: `https://securitytrails.com/domain/DOMAIN/dns` — shows NS history and A-record history with timestamps.
- Fall through to WhoisFreaks → ViewDNS.info → contact the domain owner/administrator.
- **Never infer historical nameservers from the current WHOIS record.** WHOIS shows who sold the domain (registrar), not the hosting history (nameservers).

**Example:** A domain registered at GoDaddy (registrar) may have been hosted at AWS (NS: ns-123.awsdns-45.com), then migrated to Cloudflare (NS: nora.ns.cloudflare.com). The WHOIS registrant info does not change, but the NS records do. Historical DNS records reveal the path.

## Subdomain enumeration

- **HackerTarget** — indexed subdomains (passive crawl): `curl -s "https://api.hackertarget.com/hostsearch/?q=DOMAIN"`.
- **crt.sh** — subdomains from SSL certificates (Certificate Transparency logs): `curl -s "https://crt.sh/?q=%.DOMAIN&output=json"`.
- **Combine both** for coverage: HackerTarget finds indexed DNS entries; crt.sh finds domains that had HTTPS active at some point in CT logs.

## When to use each tool

| Tool | Use Case |
|---|---|
| `dig` / Google DNS API | Real-time DNS records, current state |
| crt.sh | Historical subdomains, certificates, broad discovery |
| SecurityTrails | Historical NS records, DNS changes over time |
| WHOIS (ICANN / who.is) | Registrant, registrar, registration date, contact info |
| ipinfo.io | IP organization, ASN, geolocation, reverse hostname |
| AbuseIPDB | Abuse history, blacklist score, reporter comments |
| HackerTarget | Indexed subdomains from search engines and DNS scans |

## Common workflows

### "Find who hosts this domain"

1. Get current NS: `curl -s "https://dns.google/resolve?name=DOMAIN&type=NS"`
2. Cross-reference with known hosting NS prefixes (e.g., `*.awsdns*.com` = AWS, `*.cloudflare.com` = Cloudflare, `*.linode.com` = Linode).
3. Optionally verify with `ipinfo.io` on the A record IP.

### "Find historical nameservers before a migration"

1. Start with SecurityTrails: `https://securitytrails.com/domain/DOMAIN/dns`
2. If not available, try WhoisFreaks or ViewDNS.info.
3. Compare historical NS with current NS to identify the migration path.

### "Check if an IP is reputation-flagged"

1. `curl -s "https://ipinfo.io/IP/json"` — basic info.
2. `curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode "ipAddress=IP" -H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json"` — abuse score.

### "Enumerate all subdomains of a domain"

1. `curl -s "https://crt.sh/?q=%.DOMAIN&output=json"` — CT logs.
2. `curl -s "https://api.hackertarget.com/hostsearch/?q=DOMAIN"` — indexed scans.
3. Combine results and de-duplicate.

## Related skills

- Shell selection and CLI tooling → see your project's or organization's guidance on shell environments and available tools.
- IP-based investigations (traceroute, MTR, geolocation) → use system tools and public APIs (ipinfo.io, MaxMind, etc.).