Whois

Whois is for expanding the scope: finding the other domains the same org registered.

Whois

• https://www.whatsmydns.net/domain-name-owner

whois example.com
whois -h whois.arin.net "n 1.2.3.4"     # who owns the netblock

Pull the pivot values out of the record:

Registrant Organization
Registrant Email          →  reverse lookup
Registrant Phone          →  reverse lookup
Name Servers              →  often org-specific, best pivot

Reverse Whois

• https://tools.whoisxmlapi.com/reverse-whois-search

Search by org name, email and phone, not just the domain. This is where the acquisitions surface.

Whois History

• https://www.whoxy.com

Privacy protection is standard now, so current whois is usually empty. The pre-privacy record is not. History is where the real registrant details still live.

• https://whois-history.whoisxmlapi.com/
• https://viewdns.info/whoishistory/

Reverse nameserver

Custom nameservers (ns1.example.com) are a strong org signal: everything using them is likely the same company.

https://securitytrails.com/list/ns/ns1.example.com

Certificate transparency beats whois

For finding domains, CT logs are more reliable than whois and there is no privacy shield.

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u
curl -s "https://crt.sh/?O=Example+Inc&output=json" | jq -r '.[].name_value' | sort -u

The second one, searching by organisation rather than domain, is the one people forget. It returns every domain that org ever got a certificate for.

Confirm before you test

A shared registrant email does not put a domain in scope. Check the program’s scope page, and if it is genuinely ambiguous, ask. See Scope.

Tools