WHOIS Registration Information
  • 10 Mar 2023
  • 1 Minute to read
  • Dark
    Light

WHOIS Registration Information

  • Dark
    Light

Article summary

On a Host Indicator’s Details screen, you can enable the WHOIS feature and view WHOIS registration information, if available, for the Indicator.

New Details Screen

Enabling the WHOIS Feature

To enable the WHOIS feature for a Host Indicator, select the Enable Whois Lookups checkbox at the upper-right corner of the Whois card on the Overview tab of the Indicator’s Details screen (Figure 1).

Figure 1_WHOIS Registration Information_7.0.2

 

Note
It may take up to 60 minutes for WHOIS information to populate after selecting the Enable Whois Lookups checkbox.

Viewing WHOIS Information

The Whois card (Figure 1) will display WHOIS registration information for the Indicator if the WHOIS feature is enabled for it and such information exists. Clicking on a registrar’s entry in the table will expand it and display contact information for the registrar, if available.

Legacy Details Screen

Enabling the WHOIS Feature

To enable the WHOIS feature for a Host Indicator, select the Whois checkbox in the Details card on the Overview tab of the Indicator’s legacy Details screen (Figure 2).

Figure 2_WHOIS Registration Information_7.0.2

 

Note
It may take up to 60 minutes for WHOIS information to populate after selecting the Whois checkbox.

Viewing WHOIS Information

On a Host Indicator’s legacy Details screen, click the Whois tab and, if populated, the screen will display a results table with hyperlinked items in the Contacts column (Figure 3).

A screenshot of a computer  Description automatically generated

 

Click a hyperlink to view related Hosts in ThreatConnect that have a matching value in their WHOIS information. The Related Hosts window will be displayed (Figure 4).

Table  Description automatically generated

 

To view the full WHOIS record for an entry in the Whois results table, click Full RecordFull Record icon_WHOIS Registration Informationin the rightmost table column (Figure 3). The Whois Record window will be displayed (Figure 5).

Graphical user interface, text, application  Description automatically generated

 


ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20030-04 v.12.A


Was this article helpful?