4

Using the command line tools available in a common GNU/Linux distro (e.g. Fedora/Debian/Ubuntu/etc), is there a general way to get the value of some specific WHOIS field (e.g. the registrant's organisation name), ideally without having to build a custom WHOIS parser that is hard-coded to handle the differences between each registry's output?

This seems worth asking, because the output from the whois command does not appear to be very consistent. For example, compare:

$ whois trigger.io

[...]

Owner OrgName : Amir Nathoo

[...]

with:

$ whois facebook.com

[...]

Registrant Organization: Facebook, Inc.

[...]

I would like, instead, to be able to pass, as arguments to some command:

  • the domain name
  • the desired field

and have the output simply be the value of the desired field. For instance, based on the examples above, something like:

$ some_whois_command -field organization_name trigger.io
Amir Nathoo

$ some_whois_command -field organization_name facebook.com
Facebook, Inc.

Is this possible?

Ideally, I would like the solution to centre on the whois command, e.g. with some suitable usage of -i, -q, -t, and/or -v, as I want to learn how to make effective use of these options. I will accept another solution as correct if necessary, however.

3

The problem appears to be at least two-fold:

  • WHOIS responses do not share a common schema, and
  • there is a dearth of WHOIS clients able to parse WHOIS responses and to map their fields (e.g. using a suitable ontology) onto a single schema. The Ruby Whois project is the most extensive effort I have found. It aims to provide a parser for each of the 500+ different WHOIS servers, and its developers deserve immense credit, but it remains a work in progress.

This is a sorry state of affairs.

The IETF's proposed solution for this and other WHOIS woes is called the Registration Data Access Protocol (RDAP).

Quoting RFC 7485, which explains the rationale for RDAP:

In the domain name space, there were over 200 country code
Top-Level Domains (ccTLDs) and over 400 generic Top-Level Domains
(gTLDs) when this document was published. Different Domain Name
Registries may have different WHOIS response objects and formats.
A
common understanding of all these data formats was critical to
construct a single data model for each object.

(Emphasis mine.)

Unfortunately, whereas most (all?) TLD registries provide WHOIS servers for their subdomains, only one two TLD registries have so far formally fielded RDAP servers for their subdomains: CZNIC for .cz domains, and NIC Argentina for .ar domains. So, this is not (yet) a generally applicable solution across a wide range of TLDs. We can only hope that all the other registries will hurry up and field RDAP servers.

As for software, the only RDAP command line client for POSIX systems that I have found so far is nicinfo.

2

You may use python

 pip install whois

For instance,

#!/bin/python

import whois
print whois.whois('www.facebook.com')['city']
  • @sampablokuper many distros package things you can get from pypi, E.g. packages.debian.org/search?keywords=python-whois – casey Feb 4 '17 at 15:22
  • 1
    domain = whois.query('trigger.io') results in Exception: Unknown TLD: io, so this answer doesn't provide a general solution at all. Even for recognised TLDs, the library fails to parse the organisation name: import whois; from pprint import pprint; domain = whois.query('pcguide.com'); pprint (vars(domain)) gives just 6 fields (creation_date, expiration_date, last_updated, name, name_servers, and registrar), even though many more exist. – sampablokuper Feb 6 '17 at 13:58
-2

What fields are you interested in from what TLDs? Doign a quick check against .com .net and .org the actual data fields have the same name... easy enough to whois foo.org | grep "Registrant Organization:" or whatever field you care about.

If you need a script, something like

#!/bin/bash

if [ $# -ne 2 ]
then
  echo Usage:  $0 fieldcode domain
  exit
fi

case $1 in 
  "ro")
     whois $2 | grep "Registrant Organization:"
  ;;
  "te")
     whois $2 | grep "Tech Email:"
  ;;
esac

# or use simple if-thens
if [ $1 == "r" ]
then
  whois $2 | grep "Registrant "
fi

Which gives output like

$ ./whoisg r myfqdn.org
Registrant ID: go2016965629
Registrant Name: Contact Privacy Inc. Customer 1241082755
Registrant Organization: Contact Privacy Inc. Customer 1241082755
Registrant Street: 96 Mowat Ave
Registrant City: Toronto
Registrant State/Province: ON
Registrant Postal Code: M4K 3K1
Registrant Country: CA
Registrant Phone: +1.4165385487
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: tv4mcxdcv130@contactprivacy.email

or

$ ./whoisg te myfqdn.org
Tech Email: tv4mcxdcv130@contactprivacy.email

HTH

  • Thanks, but this would manifestly fail on the first example in my question. – sampablokuper Feb 4 '17 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.