Types of WP Queries

Domains | IP#s | Handles | IPV6 | Obfuscated | ASNs | Other | Abuse

Domain Name

Format: (sub.dom.)domain.TLD
e.g.: sourceforge.net
Domain names are the common, "simple-for-a-human" names used to identify locations within the Internet. Typically these are websites. A domain name is translated by the computer into an IP Address. Invalid or unassigned names are rejected. You must enter the TLD (top-level-domain), but queries on TLD-only (e.g. .com) are also rejected.

All TLDs on the internet that run a whois server (on port 43) can (potentially) be queried, including all 250+ two-letter country codes (ccTLDs), i.e. not just .com, .net, .org, etc. Unregistered names return "No Registrar found for your_query.tld" or sometimes "No match for your_query.cctld"

However, far too many ccTLDs do NOT run whois servers on port 43 (as required by RFC954 - see RFC-Ignorant.org) Some do run web whois applications, others simply do nothing!. WP will return URLs to their web servers or the closest thing to it if anything is known.

SubDomains: Some sites accept subdomains, others (those that handle .net, .com, .org and .edu) do not. WP strips off subdomains for registrars known not to support them, and otherwise recursively removes them from the left one by one when they return "not found" until only domain.tld remains. In other words, you can enter "www.sub.sub.domain.tld", and even if only "domain.tld" is registered, you will get your reply, along with the IP number that the name corresponds to.

IP Address

Format: ###.###.###.###
e.g.: 204.74.78.12
An Internet Protocol Address is a way to uniquely identify machines on the Internet. It is comprised of a standardized set of values separated by "."s Represented by these ### sections are a) the machine, b) the host, and c) network that it is on. Invalid (and unallocated ranges of) numbers are rejected out of hand. (See RFC3330 and RFC1700) (currently only full dotted quads are supported)

If the IP number has reverse-DNS (i.e. it maps back to a Domain Name), WP will return that name, too. The IP number can be worth checking since the owner of the name and the hosting company responsible for the IP number are usually not the same people, and when sending a spam complaint, you probably do not want to complain to the owners of the spamvertised site. You probably want their service provider!

AS Numbers

Format: AS##### or #####
e.g.: AS12008 or 12008
An Autonomous System (AS) is a group of IP networks operated by one or more network operator(s) which has a single and clearly defined external routing policy. An AS Number is used for the exchange of exterior routing information and as an identifier of the AS itself. Invalid ASNs are rejected. (See RFC1930)

NIC Handle

Format: XX###
e.g.: WGTR1-RIPE or ARIN-FOO-BAR
A NIC Handle is a unique identifier assigned to each domain name record, contact record, and network record in a registrars domain name database.

Originally handles were comprised of the contact's initials followed by a number. Now each registrar has employed its own system and it seems most of them don't work! However, clicking on a handle returned by WP (as a link) usually does. Note that WP generally only tries handles known to be valid, e.g. for ARIN, RIPE, APNIC, (and NetSol).

Forced Queries

(not implemented)

Obfuscated IP

Format: 3427052297
This is a 32 bit representation of the standard IP in octet notation (###.###.###.### ) The obfuscated IP is simply created by multiplying the first block by 2^24, second block by 2^16, third block by 2^8 , and fourth block by 2^0. Add them up and you have your obfuscated IP address. (If the IP address looks reasonable, WP will then attempt a lookup on it.)

IPv6 / IPng

Format: hex:hex:hex:hex::#/##
e.g.: 3ffe:017a:5b6c:3b1d::1/48
(Currently only partially implemented.)
This is the 128-bit representation of the 'next generation' of IP numbers.
WP attempts to verify the validity of the hexcode before querying (e.g.) whois.6bone.net, since only a very small range of such numbers will resolve.

ABUSE (whois.abuse.net)

Format: checkbox (or -a in commandline version)
With this rewrite of WP, Abuse queries have become a checkbox. When checked, whois.abuse.net is queried for an address if the query is a domain name or an IP# that maps (rDNS) to a domain name. That domain name is then looked up at Abuse.Net.

Abuse.Net returns the email address of the domain's abuse desk if it has registered one. Otherwise, it returns "postmaster@(sub.)domain.tld".

Note: there is also a configuration option to AlwaysAskAbuseNet.

WP Home | Download | Install | Help | FAQ | CHANGES | Contact | Guestbook


Valid CSS!Valid XHTML1.0!

Last modified Oct 05, 2003
Copyright © 2003 John Bro <bro (at) users (dot) sourceforge (dot) net>