WHOIS the boss? Building Your Own WHOIS Dataset for Reconnaissance

The talk starts from a common reconnaissance step: reverse WHOIS lookups on registrant details such as an email address or organization, which can reveal other apex domains a company owns. Commercial data brokers offer this but charge for access and throttle queries. The speaker recounts a continuous pentest where a second apex domain found this way exposed a hardcoded cloud credential and gave a foothold into the environment.

The middle of the talk covers building an in-house dataset. Source domains come from a free top-million list and a daily feed of newly registered domains. Lookups avoid home IP rate limits by rotating IPv6 addresses through a local SOCKS proxy, using RDAP where registrars support its JSON responses, and running a Go tool across many concurrent serverless functions on a schedule that changes the source address. The tool backs off when a registrar pushes back. Alerts fire when fields such as email, organization or registrar match a watch list, so new domains tied to a target surface quickly. Matching on registrar as well as name helps catch assets that a single field would miss.

The closing section weighs trade-offs. Data brokers keep historic records going back more than a decade, which a self-built set cannot match, and bulk data is expensive. A personal pipeline needs ongoing curation to track which lookups were throttled, but its structured output loads easily into a database. The speaker considers alerting on new registrations the most valuable outcome, and points to certificate transparency and zone data as further sources for the same kind of work.