DNS & WHOIS Tools

Investigation toolkit for DNS, WHOIS, IP reputation, and passive-DNS work. Applies to any domain or IP across public internet domains.

DNS lookup — preferred order

1. wsl dig — fullest output, supports +short, +noall +answer, ANY, AXFR, etc.
2. Google DNS API — curl -s "https://dns.google/resolve?name=DOMAIN&type=A" — works from any shell, returns JSON.
3. nslookup — works but some local resolvers may return "No response from server". Use only when 1 and 2 are unavailable.

Current DNS records

bash
# A / NS / MX / CNAME / TXT via Google DNS-over-HTTPS
curl -s "https://dns.google/resolve?name=DOMAIN&type=A|NS|MX|CNAME|TXT"

# Indexed subdomains (HackerTarget)
curl -s "https://api.hackertarget.com/hostsearch/?q=DOMAIN"

Historical / passive DNS

Use these when "what nameservers did this domain use before migrating?" or "what DNS records existed historically?" matters. They reveal records that no longer resolve.

• crt.sh (Certificate Transparency): curl -s "https://crt.sh/?q=%.DOMAIN&output=json" — reveals subdomains that ever had SSL issued (indirect evidence they existed).
• SecurityTrails — https://securitytrails.com/domain/DOMAIN/dns (WebFetch; may require account).
• WhoisFreaks — https://whoisfreaks.com/tools/dns/history/lookup/DOMAIN (WebFetch).
• DNSHistory.org — https://dnshistory.org/dns-records/DOMAIN (WebFetch).
• ViewDNS.info — https://viewdns.info/history/?domain=DOMAIN (WebFetch).

Priority order for historical nameservers: SecurityTrails (preferred, comprehensive history) → WhoisFreaks → ViewDNS.info → DNS provider customer support.

WHOIS — domain ownership and registrar information

• who.is — https://who.is/whois/DOMAIN (WebFetch).
• ICANN Lookup — https://lookup.icann.org/en/lookup?name=DOMAIN (WebFetch).
• wsl whois DOMAIN for shells with whois available.

Note: some ccTLDs (.in, .de, .uk, etc.) do not expose public WHOIS for the registrant due to regional privacy regulations.

IP reputation

ipinfo.io (organization, ASN, hostname, geolocation)

bash
curl -s "https://ipinfo.io/IP/json"

Returns: organization name, ASN, reverse hostname, country, city, ISP.

AbuseIPDB (abuse score for blacklist / nullroute decisions)

The API key should be stored in a secure vault (e.g., Bitwarden, environment variable, credential manager). Reference it as an environment variable ABUSEIPDB_API_KEY — never hardcode it.

bash
curl -G https://api.abuseipdb.com/api/v2/check \
  --data-urlencode "ipAddress=IP" \
  -H "Key: $ABUSEIPDB_API_KEY" \
  -H "Accept: application/json"

If ABUSEIPDB_API_KEY is not set in the current shell, retrieve it securely and export it for the session (export ABUSEIPDB_API_KEY=... on Bash / $env:ABUSEIPDB_API_KEY=... on PowerShell) — do not print the value to stdout or logs.

Registrar ≠ hosting provider — critical rule

Never assume the registrar (WHOIS registrant) is also the hosting provider. They are independent business relationships: a domain can be registered at GoDaddy but hosted at Linode, or registered at Namecheap and hosted at AWS.

To find historical nameservers (e.g., "what was the NS before the domain was migrated?"):

• Start with SecurityTrails: https://securitytrails.com/domain/DOMAIN/dns — shows NS history and A-record history with timestamps.
• Fall through to WhoisFreaks → ViewDNS.info → contact the domain owner/administrator.
• Never infer historical nameservers from the current WHOIS record. WHOIS shows who sold the domain (registrar), not the hosting history (nameservers).

Example: A domain registered at GoDaddy (registrar) may have been hosted at AWS (NS: ns-123.awsdns-45.com), then migrated to Cloudflare (NS: nora.ns.cloudflare.com). The WHOIS registrant info does not change, but the NS records do. Historical DNS records reveal the path.

Subdomain enumeration

• HackerTarget — indexed subdomains (passive crawl): curl -s "https://api.hackertarget.com/hostsearch/?q=DOMAIN".
• crt.sh — subdomains from SSL certificates (Certificate Transparency logs): curl -s "https://crt.sh/?q=%.DOMAIN&output=json".
• Combine both for coverage: HackerTarget finds indexed DNS entries; crt.sh finds domains that had HTTPS active at some point in CT logs.

When to use each tool

| Tool | Use Case | |---|---| | dig / Google DNS API | Real-time DNS records, current state | | crt.sh | Historical subdomains, certificates, broad discovery | | SecurityTrails | Historical NS records, DNS changes over time | | WHOIS (ICANN / who.is) | Registrant, registrar, registration date, contact info | | ipinfo.io | IP organization, ASN, geolocation, reverse hostname | | AbuseIPDB | Abuse history, blacklist score, reporter comments | | HackerTarget | Indexed subdomains from search engines and DNS scans |

Common workflows

"Find who hosts this domain"

1. Get current NS: curl -s "https://dns.google/resolve?name=DOMAIN&type=NS"
2. Cross-reference with known hosting NS prefixes (e.g., *.awsdns*.com = AWS, *.cloudflare.com = Cloudflare, *.linode.com = Linode).
3. Optionally verify with ipinfo.io on the A record IP.

"Find historical nameservers before a migration"

1. Start with SecurityTrails: https://securitytrails.com/domain/DOMAIN/dns
2. If not available, try WhoisFreaks or ViewDNS.info.
3. Compare historical NS with current NS to identify the migration path.

"Check if an IP is reputation-flagged"

1. curl -s "https://ipinfo.io/IP/json" — basic info.
2. curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode "ipAddress=IP" -H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json" — abuse score.

"Enumerate all subdomains of a domain"

1. curl -s "https://crt.sh/?q=%.DOMAIN&output=json" — CT logs.
2. curl -s "https://api.hackertarget.com/hostsearch/?q=DOMAIN" — indexed scans.
3. Combine results and de-duplicate.

Related skills

• Shell selection and CLI tooling → see your project's or organization's guidance on shell environments and available tools.
• IP-based investigations (traceroute, MTR, geolocation) → use system tools and public APIs (ipinfo.io, MaxMind, etc.).