Whois

Provides data enrichment for domains.

Data Enrichment & Threat Intelligence · Whois

Details

ID	`Whois`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/ippysocks-py3:1.0.0.11195141`
Supported Modules	Agentix XSIAM

README

Provides data enrichment for domains.
This integration was integrated and tested with version 1.0 of Whois

Configure Whois in Cortex

Parameter	Description	Required
Return Errors	If set, failed command results will be returned as warnings instead of errors.	False
Proxy URL	Supports socks4/socks5/http connect proxies (e.g. socks5h://host:1080). Will effect all commands except for the `ip` command.	False
Use system proxy settings	Effect the `ip` command and the other commands only if the Proxy URL is not set.	False
Use legacy context	Indicates whether to use the previous/legacy implementation of the integration commands and their outputs or the new ones.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Rate Limit Retry Count	The number of times to try when getting a Rate Limit response.	False
Rate Limit Wait Seconds	The number of seconds to wait between each iteration when getting a Rate Limit response.	False
Suppress Rate Limit errors	Whether Rate Limit errors should be supressed or not.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

whois

Provides data enrichment for domains.
This pack relies on free services for WHOIS information. As with many free services, the availability is not guaranteed. Free WHOIS providers may block or be reject queries.

Base Command

whois

Input

Argument Name	Description	Required
query	The domain to enrich.	Required
recursive	Whether to get the raw response from the whois servers recursively. Default value is True.	Optional
verbose	Whether to add the raw response as a dictionary to the context.	Optional

Context Output

Path	Type	Description
DBotScore.Score	string	The actual score.
DBotScore.Indicator	string	The indicator that was tested.
DBotScore.Type	string	The indicator type.
DBotScore.Vendor	string	The vendor used to calculate the score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Domain.Name	string	The domain name.
Domain.DomainStatus	string	The domain status.
Domain.Dnssec	string	The domain name system security extension (DNSSEC).
Domain.NameServers	string	The name servers.
Domain.Country	string	The domain country.
Domain.State	string	The domain state.
Domain.City	string	The domain city.
Domain.CreationDate	date	The date that the domain was created (UTC).
Domain.UpdatedDate	date	The date that the domain was last updated (UTC).
Domain.ExpirationDate	date	The date that the domain expires (UTC).
Domain.Registrar.Name	string	The name of the registrar.
Domain.Registrar.Address	string	The address of the registrar.
Domain.Registrar.Email	string	The email of the registrar.
Domain.Registrar.Id	string	The ID of the registrar.
Domain.Registrar.Phone	string	The phone number of the registrar.
Domain.Registrar.Url	string	The URL of the registrar.
Domain.Registrar.AbuseEmail	string	The email address of the contact for reporting abuse.
Domain.Emails	string	The abuse emails.
Domain.Address	string	The abuse address.
Domain.Organization	string	The organization domain name.
Domain.WhoisServer	string	The whois server name.
Domain.Phone	string	The phone number of the tech administrator.
Domain.Admin	object	Administrator information.
Domain.Admin.Address	string	The address of the administrator.
Domain.Admin.ApplicationPurpose	string	The application purpose of the administrator.
Domain.Admin.C	string	The C field of the administrator.
Domain.Admin.City	string	The city of the administrator.
Domain.Admin.Country	string	The country of the administrator.
Domain.Admin.Email	string	The email address of the administrator.
Domain.Admin.Fax	string	The fax number of the administrator.
Domain.Admin.FaxExt	string	The fax extension of the administrator.
Domain.Admin.Id	string	The ID of the administrator.
Domain.Admin.Name	string	The name of the administrator.
Domain.Admin.Org	string	The organization of the administrator.
Domain.Admin.Phone	string	The phone number of the administrator.
Domain.Admin.PhoneExt	string	The phone extension of the administrator.
Domain.Admin.PostalCode	string	The postal code of the administrator.
Domain.Admin.State	string	The state of the administrator.
Domain.Admin.StateProvince	string	The state or province of the administrator.
Domain.Admin.Street	string	The street of the administrator.
Domain.Registrant.Name	string	The name of the registrant.
Domain.Registrant.Email	string	The email address of the registrant.
Domain.Registrant.Country	string	The country of the registrant.
Domain.Registrant.State	string	The state of the registrant.
Domain.Registrant.Org	string	The organization of the registrant.
Domain.Registrant.PostalCode	string	The postal code of the registrant.
Domain.Registrant.Street	string	The street of the registrant.
Domain.Registrant.Phone	string	The phone number of the registrant.
Domain.Registrant.City	string	The city of the registrant.
Domain.Registrant.Address	string	The address of the registrant.
Domain.Registrant.ContactName	string	The contact name of the registrant.
Domain.Registrant.Fax	string	The fax of the registrant.
Domain.Registrant.Id	string	The ID of the registrant.
Domain.Registrant.Number	string	The number of the registrant.
Domain.Registrant.StateProvince	string	The state province of the registrant.
Domain.Raw	string	The raw output from python-whois lib.
Domain.Administrator	string	The country of the domain administrator.
Domain.Tech.Name	string	The name of the tech contact.
Domain.Tech.Address	string	The address of the tech contact.
Domain.Tech.City	string	The city of the tech contact.
Domain.Tech.Country	string	The country of the tech contact.
Domain.Tech.Email	string	The email address of the tech contact.
Domain.Tech.Fax	string	The fax number of the tech contact.
Domain.Tech.ID	string	The ID of the tech contact.
Domain.Tech.Organization	string	The organization of the tech contact.
Domain.Tech.Phone	string	The phone number of the tech contact.
Domain.Tech.PostalCode	string	The postal code of the tech contact.
Domain.Tech.State	string	The state of the tech contact.
Domain.Tech.StateProvince	string	The state/province of the tech contact.
Domain.Tech.Street	string	The street of the tech contact.
Domain.ID	string	The ID of the domain.
Domain.WHOIS.Name	string	The domain name.
Domain.WHOIS.DomainStatus	string	The domain status.
Domain.WHOIS.Dnssec	string	The domain name system security extension (DNSSEC).
Domain.WHOIS.NameServers	string	The name servers.
Domain.WHOIS.Country	string	The domain country.
Domain.WHOIS.State	string	The domain state.
Domain.WHOIS.City	string	The domain city.
Domain.WHOIS.CreationDate	date	The date that the domain was created (UTC).
Domain.WHOIS.UpdatedDate	date	The date that the domain was last updated (UTC).
Domain.WHOIS.ExpirationDate	date	The date that the domain expires (UTC).
Domain.WHOIS.Registrar.Name	string	The name of the registrar.
Domain.WHOIS.Registrar.Address	string	The address of the registrar.
Domain.WHOIS.Registrar.Email	string	The email of the registrar.
Domain.WHOIS.Registrar.Id	string	The ID of the registrar.
Domain.WHOIS.Registrar.Phone	string	The phone number of the registrar.
Domain.WHOIS.Registrar.Url	string	The URL of the registrar.
Domain.WHOIS.Registrar.AbuseEmail	string	The email address of the contact for reporting abuse.
Domain.WHOIS.Emails	string	The abuse emails.
Domain.WHOIS.Address	string	The abuse address.
Domain.WHOIS.Organization	string	The organization domain name.
Domain.WHOIS.WhoisServer	string	The whois server name.
Domain.WHOIS.Phone	string	The phone number of the tech administrator.
Domain.WHOIS.Admin	object	Administrator information.
Domain.WHOIS.Admin.Address	string	The address of the administrator.
Domain.WHOIS.Admin.ApplicationPurpose	string	The application purpose of the administrator.
Domain.WHOIS.Admin.C	string	The C field of the administrator.
Domain.WHOIS.Admin.City	string	The city of the administrator.
Domain.WHOIS.Admin.Country	string	The country of the administrator.
Domain.WHOIS.Admin.Email	string	The email address of the administrator.
Domain.WHOIS.Admin.Fax	string	The fax number of the administrator.
Domain.WHOIS.Admin.FaxExt	string	The fax extension of the administrator.
Domain.WHOIS.Admin.Id	string	The ID of the administrator.
Domain.WHOIS.Admin.Name	string	The name of the administrator.
Domain.WHOIS.Admin.Org	string	The organization of the administrator.
Domain.WHOIS.Admin.Phone	string	The phone number of the administrator.
Domain.WHOIS.Admin.PhoneExt	string	The phone extension of the administrator.
Domain.WHOIS.Admin.PostalCode	string	The postal code of the administrator.
Domain.WHOIS.Admin.State	string	The state of the administrator.
Domain.WHOIS.Admin.StateProvince	string	The state or province of the administrator.
Domain.WHOIS.Admin.Street	string	The street of the administrator.
Domain.WHOIS.Registrant.Name	string	The name of the registrant.
Domain.WHOIS.Registrant.Email	string	The email address of the registrant.
Domain.WHOIS.Registrant.Country	string	The country of the registrant.
Domain.WHOIS.Registrant.State	string	The state of the registrant.
Domain.WHOIS.Registrant.Org	string	The organization of the registrant.
Domain.WHOIS.Registrant.PostalCode	string	The postal code of the registrant.
Domain.WHOIS.Registrant.Street	string	The street of the registrant.
Domain.WHOIS.Registrant.Phone	string	The phone number of the registrant.
Domain.WHOIS.Registrant.City	string	The city of the registrant.
Domain.WHOIS.Registrant.Address	string	The address of the registrant.
Domain.WHOIS.Registrant.ContactName	string	The contact name of the registrant.
Domain.WHOIS.Registrant.Fax	string	The fax of the registrant.
Domain.WHOIS.Registrant.Id	string	The ID of the registrant.
Domain.WHOIS.Registrant.Number	string	The number of the registrant.
Domain.WHOIS.Registrant.StateProvince	string	The state province of the registrant.
Domain.WHOIS.Raw	string	The raw output from python-whois lib.
Domain.WHOIS.Administrator	string	The country of the domain administrator.
Domain.WHOIS.Tech.Name	string	The name of the tech contact.
Domain.WHOIS.Tech.Address	string	The address of the tech contact.
Domain.WHOIS.Tech.City	string	The city of the tech contact.
Domain.WHOIS.Tech.Country	string	The country of the tech contact.
Domain.WHOIS.Tech.Email	string	The email address of the tech contact.
Domain.WHOIS.Tech.Fax	string	The fax number of the tech contact.
Domain.WHOIS.Tech.ID	string	The ID of the tech contact.
Domain.WHOIS.Tech.Org	string	The organization of the tech contact.
Domain.WHOIS.Tech.Phone	string	The phone number of the tech contact.
Domain.WHOIS.Tech.PostalCode	string	The postal code of the tech contact.
Domain.WHOIS.Tech.State	string	The state of the tech contact.
Domain.WHOIS.Tech.StateProvince	string	The state/province of the tech contact.
Domain.WHOIS.Tech.Street	string	The street of the tech contact.
Domain.WHOIS.ID	string	The ID of the domain.
Domain.FeedRelatedIndicators.Type	String	Indicators that are associated with the domain.
Domain.FeedRelatedIndicators.Value	String	The type of the indicators that are associated with the domain.
Domain.WHOIS.FeedRelatedIndicators.Type	String	Indicators that are associated with the domain.
Domain.WHOIS.FeedRelatedIndicators.Value	String	The type of the indicators that are associated with the domain.
Domain.FeedRelatedIndicators.type	String	(Legacy output) Indicators that are associated with the domain.
Domain.FeedRelatedIndicators.value	String	(Legacy output) The type of the indicators that are associated with the domain.
Domain.Whois.Name	string	(Legacy output) The domain name.
Domain.Whois.DomainStatus	string	(Legacy output) The domain status.
Domain.Whois.DNSSec	string	(Legacy output) The domain name system security extension (DNSSEC).
Domain.Whois.NameServers	string	(Legacy output) The name servers.
Domain.Whois.CreationDate	date	(Legacy output) The date that the domain was created (UTC).
Domain.Whois.UpdatedDate	date	(Legacy output)The date that the domain was last updated (UTC).
Domain.Whois.ExpirationDate	date	(Legacy output)The date that the domain expires (UTC).
Domain.Whois.Registrar.Name	string	(Legacy output)The name of the registrar.
Domain.Whois.Emails	string	(Legacy output)The abuse emails.
Domain.Whois.Registrar.AbuseEmail	string	(Legacy output) The email address of the contact for reporting abuse.
Domain.Whois.Registrant.name	string	(Legacy output) The name of the registrant.
Domain.Whois.Registrant.email	string	(Legacy output) The email address of the registrant.
Domain.Whois.Raw	string	(Legacy output) The raw output.
Domain.Whois.Administrator.country	string	(Legacy output) The country of the domain administrator.
Domain.Whois.Administrator.name	string	(Legacy output) The name of the domain administrator.
Domain.Whois.Administrator.state	string	(Legacy output) The state of the domain administrator.
Domain.Whois.Administrator.email	string	(Legacy output) The email address of the domain administrator.
Domain.Whois.Administrator.organization	string	(Legacy output) The organization of the domain administrator.
Domain.Whois.Administrator.postalcode	string	(Legacy output) The postal code of the domain administrator.
Domain.Whois.Administrator.street	string	(Legacy output) The street of the the domain admin.
Domain.Whois.Administrator.phone	string	(Legacy output) The phone number of the domain administrator.
Domain.Whois.Administrator.city	string	(Legacy output) The city of the domain administrator.
Domain.Whois.TechAdmin.country	string	(Legacy output) The country of the tech administrator.
Domain.Whois.TechAdmin.name	string	(Legacy output) The name of the tech administrator.
Domain.Whois.TechAdmin.state	string	(Legacy output) The state of the tech administrator.
Domain.Whois.TechAdmin.email	string	(Legacy output) The email address of the tech administrator.
Domain.Whois.TechAdmin.organization	string	(Legacy output) The organization of the tech administrator.
Domain.Whois.TechAdmin.postalcode	string	(Legacy output) The postal code of the tech administrator.
Domain.Whois.TechAdmin.street	string	(Legacy output) The street of the tech administrator.
Domain.Whois.TechAdmin.phone	string	(Legacy output) The phone number of the tech administrator.
Domain.Whois.TechAdmin.city	string	(Legacy output) The city of the tech administrator.
Domain.Whois.Registrant.country	string	(Legacy output) The country of the registrant.
Domain.Whois.Registrant.state	string	(Legacy output) The state of the registrant.
Domain.Whois.Registrant.organization	string	(Legacy output) The organization of the registrant.
Domain.Whois.Registrant.postalcode	string	(Legacy output) The postal code of the registrant.
Domain.Whois.Registrant.street	string	(Legacy output) The street of the registrant.
Domain.Whois.Registrant.phone	string	(Legacy output) The phone number of the registrant.
Domain.Whois.Registrant.city	string	(Legacy output) The city of the registrant.
Domain.Whois.ID	string	(Legacy output) The ID of the domain.
Domain.Whois.QueryStatus	string	(Legacy output) The result of the command (“Success” or “Failed”).
Domain.Whois.QueryValue	string	(Legacy output) The query requested by the user.
Domain.Whois.QueryResult	Boolean	(Legacy output) Whether the query found a matching result.

Command example

!whois query="paloaltonetworks.com"

Context Example

{
    "DBotScore": {
        "Indicator": "google.com",
        "Type": "domain",
        "Vendor": "Whois",
        "Score": 0,
        "Reliability": "B - Usually reliable"
    },
    "Domain": {
        "WHOIS": {
            "Name": "paloaltonetworks.com",
            "WhoisServer": "whois.markmonitor.com",
            "CreationDate": "21-02-2005",
            "ExpirationDate": "21-02-2026",
            "UpdatedDate": "08-02-2024",
            "Organization": "Palo Alto Networks, Inc.",
            "State": "CA",
            "Country": "US",
            "Dnssec": "signedDelegation",
            "Registrar": {
                "Name": "MarkMonitor, Inc."
            },
            "Emails": [
                "abusecomplaints@markmonitor.com",
                "whoisrequest@markmonitor.com"
            ],
            "NameServers": [
                "a1-184.akam.net",
                "a11-64.akam.net",
                "a12-67.akam.net",
                "a13-66.akam.net",
                "a2-65.akam.net",
                "a4-64.akam.net"
            ],
            "DomainStatus": [
                "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
                "clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
                "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited",
                "clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)",
                "clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)",
                "clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)"
            ],
            "FeedRelatedIndicators": [
                {
                    "Type": "email",
                    "Value": "abusecomplaints@markmonitor.com"
                },
                {
                    "Type": "email",
                    "Value": "whoisrequest@markmonitor.com"
                }
            ],
            "Raw": "domain_name: ['PALOALTONETWORKS.COM', 'paloaltonetworks.com'], registrar: MarkMonitor, Inc., whois_server: whois.markmonitor.com, referral_url: None, updated_date: [datetime.datetime(2024, 2, 8, 6, 27, 19), datetime.datetime(2024, 2, 8, 6, 27, 19, tzinfo=datetime.timezone.utc)], creation_date: [datetime.datetime(2005, 2, 21, 2, 42, 10), datetime.datetime(2005, 2, 21, 2, 42, 10, tzinfo=datetime.timezone.utc)], expiration_date: [datetime.datetime(2026, 2, 21, 2, 42, 10), datetime.datetime(2026, 2, 21, 0, 0, tzinfo=datetime.timezone.utc)], name_servers: ['A1-184.AKAM.NET', 'A11-64.AKAM.NET', 'A12-67.AKAM.NET', 'A13-66.AKAM.NET', 'A2-65.AKAM.NET', 'A4-64.AKAM.NET', 'a1-184.akam.net', 'a4-64.akam.net', 'a2-65.akam.net', 'a13-66.akam.net', 'a12-67.akam.net', 'a11-64.akam.net'], status: ['clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited', 'clientTransferProhibited https://icann.org/epp#clientTransferProhibited', 'clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited', 'clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)', 'clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)', 'clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)'], emails: ['abusecomplaints@markmonitor.com', 'whoisrequest@markmonitor.com'], dnssec: signedDelegation, name: None, org: Palo Alto Networks, Inc., address: None, city: None, state: CA, registrant_postal_code: None, country: US"
        },
        "Name": "paloaltonetworks.com",
        "WhoisServer": "whois.markmonitor.com",
        "CreationDate": "21-02-2005",
        "ExpirationDate": "21-02-2026",
        "UpdatedDate": "08-02-2024",
        "Organization": "Palo Alto Networks, Inc.",
        "State": "CA",
        "Country": "US",
        "Dnssec": "signedDelegation",
        "Registrar": {
            "Name": "MarkMonitor, Inc."
        },
        "Emails": [
            "abusecomplaints@markmonitor.com",
            "whoisrequest@markmonitor.com"
        ],
        "NameServers": [
            "a1-184.akam.net",
            "a11-64.akam.net",
            "a12-67.akam.net",
            "a13-66.akam.net",
            "a2-65.akam.net",
            "a4-64.akam.net"
        ],
        "DomainStatus": [
            "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
            "clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
            "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited",
            "clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)",
            "clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)",
            "clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)"
        ],
        "FeedRelatedIndicators": [
            {
                "Type": "email",
                "Value": "abusecomplaints@markmonitor.com"
            },
            {
                "Type": "email",
                "Value": "whoisrequest@markmonitor.com"
            }
        ],
        "Raw": "domain_name: ['PALOALTONETWORKS.COM', 'paloaltonetworks.com'], registrar: MarkMonitor, Inc., whois_server: whois.markmonitor.com, referral_url: None, updated_date: [datetime.datetime(2024, 2, 8, 6, 27, 19), datetime.datetime(2024, 2, 8, 6, 27, 19, tzinfo=datetime.timezone.utc)], creation_date: [datetime.datetime(2005, 2, 21, 2, 42, 10), datetime.datetime(2005, 2, 21, 2, 42, 10, tzinfo=datetime.timezone.utc)], expiration_date: [datetime.datetime(2026, 2, 21, 2, 42, 10), datetime.datetime(2026, 2, 21, 0, 0, tzinfo=datetime.timezone.utc)], name_servers: ['A1-184.AKAM.NET', 'A11-64.AKAM.NET', 'A12-67.AKAM.NET', 'A13-66.AKAM.NET', 'A2-65.AKAM.NET', 'A4-64.AKAM.NET', 'a1-184.akam.net', 'a4-64.akam.net', 'a2-65.akam.net', 'a13-66.akam.net', 'a12-67.akam.net', 'a11-64.akam.net'], status: ['clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited', 'clientTransferProhibited https://icann.org/epp#clientTransferProhibited', 'clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited', 'clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)', 'clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)', 'clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)'], emails: ['abusecomplaints@markmonitor.com', 'whoisrequest@markmonitor.com'], dnssec: signedDelegation, name: None, org: Palo Alto Networks, Inc., address: None, city: None, state: CA, registrant_postal_code: None, country: US"
    }
}

Human Readable Output

Whois results for paloaltonetworks.com

Name CreationDate ExpirationDate UpdatedDate NameServers Organization Registrar DomainStatus Emails WhoisServer

paloaltonetworks.com 21-02-2005 21-02-2026 08-02-2024 a1-184.akam.net,
a11-64.akam.net,
a12-67.akam.net,
a13-66.akam.net,
a2-65.akam.net,
a4-64.akam.net Palo Alto Networks, Inc. Name: MarkMonitor, Inc. clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited,
clientTransferProhibited https://icann.org/epp#clientTransferProhibited,
clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited,
clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited),
clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited),
clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited) abusecomplaints@markmonitor.com,
whoisrequest@markmonitor.com whois.markmonitor.com

Name	CreationDate	ExpirationDate	UpdatedDate	NameServers	Organization	Registrar	DomainStatus	Emails	WhoisServer
paloaltonetworks.com	21-02-2005	21-02-2026	08-02-2024	a1-184.akam.net, a11-64.akam.net, a12-67.akam.net, a13-66.akam.net, a2-65.akam.net, a4-64.akam.net	Palo Alto Networks, Inc.	Name: MarkMonitor, Inc.	clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited), clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited), clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)	abusecomplaints@markmonitor.com, whoisrequest@markmonitor.com	whois.markmonitor.com

domain

Provides data enrichment for domains.

Base Command

domain

Input

Argument Name	Description	Required
domain	The domain to enrich.	Required
recursive	Whether to get the raw response from the whois servers recursively. Default value is True.	Optional

Context Output

Path	Type	Description
DBotScore.Score	string	The actual score.
DBotScore.Indicator	string	The indicator that was tested.
DBotScore.Type	string	The indicator type.
DBotScore.Vendor	string	The vendor used to calculate the score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Domain.Name	string	The domain name.
Domain.DomainStatus	String	The domain status.
Domain.ExpirationDate	Date	The date that the domain expires (UTC).
Domain.NameServers	String	The name servers.
Domain.Organization	String	The organization name.
Domain.ID	string	The ID of the domain.
Domain.UpdatedDate	Date	The date that the domain was last updated (UTC).
Domain.Dnssec	string	The domain name system security extension (DNSSEC).
Domain.Country	string	The domain country.
Domain.State	string	The domain state.
Domain.City	string	The domain city.
Domain.CreationDate	date	The date that the domain was created (UTC).
Domain.Registrar.Name	string	The name of the registrar.
Domain.Registrar.Address	string	The address of the registrar.
Domain.Registrar.Email	string	The email of the registrar.
Domain.Registrar.Id	string	The ID of the registrar.
Domain.Registrar.Phone	string	The phone number of the registrar.
Domain.Registrar.Url	string	The URL of the registrar.
Domain.Registrar.AbuseEmail	string	The email address of the contact for reporting abuse.
Domain.Emails	string	The abuse emails.
Domain.Address	string	The abuse address.
Domain.WhoisServer	string	The whois server name.
Domain.Phone	string	The phone number of the tech administrator.
Domain.Admin	object	Administrator information.
Domain.Admin.Address	string	The address of the administrator.
Domain.Admin.ApplicationPurpose	string	The application purpose of the administrator.
Domain.Admin.C	string	The C field of the administrator.
Domain.Admin.City	string	The city of the administrator.
Domain.Admin.Country	string	The country of the administrator.
Domain.Admin.Email	string	The email address of the administrator.
Domain.Admin.Fax	string	The fax number of the administrator.
Domain.Admin.FaxExt	string	The fax extension of the administrator.
Domain.Admin.Id	string	The ID of the administrator.
Domain.Admin.Name	string	The name of the administrator.
Domain.Admin.Org	string	The organization of the administrator.
Domain.Admin.Phone	string	The phone number of the administrator.
Domain.Admin.PhoneExt	string	The phone extension of the administrator.
Domain.Admin.PostalCode	string	The postal code of the administrator.
Domain.Admin.State	string	The state of the administrator.
Domain.Admin.StateProvince	string	The state or province of the administrator.
Domain.Admin.Street	string	The street of the administrator.
Domain.Registrant.Name	string	The name of the registrant.
Domain.Registrant.Email	string	The email address of the registrant.
Domain.Registrant.Country	string	The country of the registrant.
Domain.Registrant.State	string	The state of the registrant.
Domain.Registrant.Org	string	The organization of the registrant.
Domain.Registrant.PostalCode	string	The postal code of the registrant.
Domain.Registrant.Street	string	The street of the registrant.
Domain.Registrant.Phone	string	The phone number of the registrant.
Domain.Registrant.City	string	The city of the registrant.
Domain.Registrant.Address	string	The address of the registrant.
Domain.Registrant.ContactName	string	The contact name of the registrant.
Domain.Registrant.Fax	string	The fax of the registrant.
Domain.Registrant.Id	string	The ID of the registrant.
Domain.Registrant.Number	string	The number of the registrant.
Domain.Registrant.StateProvince	string	The state province of the registrant.
Domain.Raw	string	The raw output from python-whois lib.
Domain.Administrator	string	The country of the domain administrator.
Domain.Tech.Name	string	The name of the tech contact.
Domain.Tech.Address	string	The address of the tech contact.
Domain.Tech.City	string	The city of the tech contact.
Domain.Tech.Country	string	The country of the tech contact.
Domain.Tech.Email	string	The email address of the tech contact.
Domain.Tech.Fax	string	The fax number of the tech contact.
Domain.Tech.ID	string	The ID of the tech contact.
Domain.Tech.Org	string	The organization of the tech contact.
Domain.Tech.Phone	string	The phone number of the tech contact.
Domain.Tech.PostalCode	string	The postal code of the tech contact.
Domain.Tech.State	string	The state of the tech contact.
Domain.Tech.StateProvince	string	The state/province of the tech contact.
Domain.Tech.Street	string	The street of the tech contact.
Domain.FeedRelatedIndicators.Type	String	Indicators that are associated with the domain.
Domain.FeedRelatedIndicators.Value	String	The type of the indicators that are associated with the domain.
Domain.WHOIS.FeedRelatedIndicators.Type	String	Indicators that are associated with the domain.
Domain.WHOIS.FeedRelatedIndicators.Value	String	The type of the indicators that are associated with the domain.
Domain.WHOIS.Name	string	The domain name.
Domain.WHOIS.ID	string	The ID of the domain.
Domain.WHOIS.DomainStatus	string	The domain status.
Domain.WHOIS.Dnssec	string	The domain name system security extension (DNSSEC).
Domain.WHOIS.NameServers	string	The name servers.
Domain.WHOIS.Country	string	The domain country.
Domain.WHOIS.State	string	The domain state.
Domain.WHOIS.City	string	The domain city.
Domain.WHOIS.CreationDate	date	The date that the domain was created (UTC).
Domain.WHOIS.UpdatedDate	date	The date that the domain was last updated (UTC).
Domain.WHOIS.ExpirationDate	date	The date that the domain expires (UTC).
Domain.WHOIS.Registrar.Name	string	The name of the registrar.
Domain.WHOIS.Registrar.Address	string	The address of the registrar.
Domain.WHOIS.Registrar.Email	string	The email of the registrar.
Domain.WHOIS.Registrar.Id	string	The ID of the registrar.
Domain.WHOIS.Registrar.Phone	string	The phone number of the registrar.
Domain.WHOIS.Registrar.Url	string	The URL of the registrar.
Domain.WHOIS.Registrar.AbuseEmail	string	The email address of the contact for reporting abuse.
Domain.WHOIS.Emails	string	The abuse emails.
Domain.WHOIS.Address	string	The abuse address.
Domain.WHOIS.Organization	string	The organization domain name.
Domain.WHOIS.WhoisServer	string	The whois server name.
Domain.WHOIS.Phone	string	The phone number of the tech administrator.
Domain.WHOIS.Admin	object	Administrator information.
Domain.WHOIS.Admin.Address	string	The address of the administrator.
Domain.WHOIS.Admin.ApplicationPurpose	string	The application purpose of the administrator.
Domain.WHOIS.Admin.C	string	The C field of the administrator.
Domain.WHOIS.Admin.City	string	The city of the administrator.
Domain.WHOIS.Admin.Country	string	The country of the administrator.
Domain.WHOIS.Admin.Email	string	The email address of the administrator.
Domain.WHOIS.Admin.Fax	string	The fax number of the administrator.
Domain.WHOIS.Admin.FaxExt	string	The fax extension of the administrator.
Domain.WHOIS.Admin.Id	string	The ID of the administrator.
Domain.WHOIS.Admin.Name	string	The name of the administrator.
Domain.WHOIS.Admin.Org	string	The organization of the administrator.
Domain.WHOIS.Admin.Phone	string	The phone number of the administrator.
Domain.WHOIS.Admin.PhoneExt	string	The phone extension of the administrator.
Domain.WHOIS.Admin.PostalCode	string	The postal code of the administrator.
Domain.WHOIS.Admin.State	string	The state of the administrator.
Domain.WHOIS.Admin.StateProvince	string	The state or province of the administrator.
Domain.WHOIS.Admin.Street	string	The street of the administrator.
Domain.WHOIS.Registrant.Name	string	The name of the registrant.
Domain.WHOIS.Registrant.Email	string	The email address of the registrant.
Domain.WHOIS.Registrant.Country	string	The country of the registrant.
Domain.WHOIS.Registrant.State	string	The state of the registrant.
Domain.WHOIS.Registrant.Org	string	The organization of the registrant.
Domain.WHOIS.Registrant.PostalCode	string	The postal code of the registrant.
Domain.WHOIS.Registrant.Street	string	The street of the registrant.
Domain.WHOIS.Registrant.Phone	string	The phone number of the registrant.
Domain.WHOIS.Registrant.City	string	The city of the registrant.
Domain.WHOIS.Registrant.Address	string	The address of the registrant.
Domain.WHOIS.Registrant.ContactName	string	The contact name of the registrant.
Domain.WHOIS.Registrant.Fax	string	The fax of the registrant.
Domain.WHOIS.Registrant.Id	string	The ID of the registrant.
Domain.WHOIS.Registrant.Number	string	The number of the registrant.
Domain.WHOIS.Registrant.StateProvince	string	The state province of the registrant.
Domain.WHOIS.Raw	string	The raw output from python-whois lib.
Domain.WHOIS.Administrator	string	The country of the domain administrator.
Domain.WHOIS.Tech.Name	string	The name of the tech contact.
Domain.WHOIS.Tech.Address	string	The address of the tech contact.
Domain.WHOIS.Tech.City	string	The city of the tech contact.
Domain.WHOIS.Tech.Country	string	The country of the tech contact.
Domain.WHOIS.Tech.Email	string	The email address of the tech contact.
Domain.WHOIS.Tech.Fax	string	The fax number of the tech contact.
Domain.WHOIS.Tech.ID	string	The ID of the tech contact.
Domain.WHOIS.Tech.Org	string	The organization of the tech contact.
Domain.WHOIS.Tech.Phone	string	The phone number of the tech contact.
Domain.WHOIS.Tech.PostalCode	string	The postal code of the tech contact.
Domain.WHOIS.Tech.State	string	The state of the tech contact.
Domain.WHOIS.Tech.StateProvince	string	The state/province of the tech contact.
Domain.WHOIS.Tech.Street	string	The street of the tech contact.
Domain.Whois.Name	string	(Legacy output) The domain name.
Domain.Whois.DomainStatus	string	(Legacy output) The domain status.
Domain.Whois.DNSSec	string	(Legacy output) The domain name system security extension (DNSSEC).
Domain.Whois.NameServers	string	(Legacy output) The name servers.
Domain.Whois.CreationDate	date	(Legacy output) The date that the domain was created (UTC).
Domain.Whois.UpdatedDate	date	(Legacy output) The date that the domain was last updated (UTC).
Domain.Whois.ExpirationDate	date	(Legacy output) The date that the domain expires (UTC).
Domain.Whois.Registrar.Name	string	(Legacy output) The name of the registrar.
Domain.Whois.Emails	string	(Legacy output) The abuse emails.
Domain.Whois.Registrar.AbuseEmail	string	(Legacy output) The email address of the contact for reporting abuse.
Domain.Whois.Registrant.name	string	(Legacy output) The name of the registrant.
Domain.Whois.Registrant.email	string	(Legacy output) The email address of the registrant.
Domain.Whois.Raw	string	(Legacy output) The raw output.
Domain.Whois.Administrator.country	string	(Legacy output) The country of the domain administrator.
Domain.Whois.Administrator.name	string	(Legacy output) The name of the domain administrator.
Domain.Whois.Administrator.state	string	(Legacy output) The state of the domain administrator.
Domain.Whois.Administrator.email	string	(Legacy output) The email address of the domain administrator.
Domain.Whois.Administrator.organization	string	(Legacy output) The organization of the domain administrator.
Domain.Whois.Administrator.postalcode	string	(Legacy output) The postal code of the domain administrator.
Domain.Whois.Administrator.street	string	(Legacy output) The street of the domain administrator.
Domain.Whois.Administrator.phone	string	(Legacy output) The phone number of the domain administrator.
Domain.Whois.Administrator.city	string	(Legacy output) The city of the domain administrator.
Domain.Whois.TechAdmin.country	string	(Legacy output) The country of the tech administrator.
Domain.Whois.TechAdmin.name	string	(Legacy output) The name of the tech administrator.
Domain.Whois.TechAdmin.state	string	(Legacy output) The state of the tech administrator.
Domain.Whois.TechAdmin.email	string	(Legacy output) The email address of the tech administrator.
Domain.Whois.TechAdmin.organization	string	(Legacy output) The organization of the tech administrator.
Domain.Whois.TechAdmin.postalcode	string	(Legacy output) The postal code of the tech administrator.
Domain.Whois.TechAdmin.street	string	(Legacy output) The street of the tech administrator.
Domain.Whois.TechAdmin.phone	string	(Legacy output) The phone number of the tech administrator.
Domain.Whois.TechAdmin.city	string	(Legacy output) The city of the tech administrator.
Domain.Whois.Registrant.country	string	(Legacy output) The country of the registrant.
Domain.Whois.Registrant.state	string	(Legacy output) The state of the registrant.
Domain.Whois.Registrant.organization	string	(Legacy output) The organization of the registrant.
Domain.Whois.Registrant.postalcode	string	(Legacy output) The postal code of the registrant.
Domain.Whois.Registrant.street	string	(Legacy output) The street of the registrant.
Domain.Whois.Registrant.phone	string	(Legacy output) The phone number of the registrant.
Domain.Whois.Registrant.city	string	(Legacy output) The city of the registrant.
Domain.Whois.ID	string	(Legacy output) The ID of the domain.
Domain.Whois.QueryStatus	string	(Legacy output) The result of the command (“Success” or “Failed”).
Domain.Whois.QueryResult	Boolean	(Legacy output) Whether the query found a matching result.
Domain.Admin.Country	String	(Legacy output) The country of the domain administrator.
Domain.Admin.Name	String	(Legacy output) The name of domain administrator.
Domain.Admin.State	String	(Legacy output) The state of domain administrator.
Domain.Admin.country	String	(Legacy output) The country of the domain administrator.
Domain.Admin.name	String	(Legacy output) The name of domain administrator.
Domain.Admin.state	String	(Legacy output) The state of domain administrator.
Domain.Registrant.country	String	(Legacy output) The country of the registrant.
Domain.Registrant.organization	String	(Legacy output) The organization of the registrant.
Domain.Registrant.state	String	(Legacy output) The state of the registrant.
Domain.FeedRelatedIndicators.type	String	(Legacy output) Indicators that are associated with the domain.
Domain.FeedRelatedIndicators.value	String	(Legacy output) The type of the indicators that are associated with the domain.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.

Command example

!domain domain="google.com"

Context Example

{
    "DBotScore": {
        "Indicator": "google.com",
        "Type": "domain",
        "Vendor": "Whois",
        "Score": 0,
        "Reliability": "B - Usually reliable"
    },
    "Domain": {
        "WHOIS": {
            "Name": "google.com",
            "WhoisServer": "whois.markmonitor.com",
            "CreationDate": "15-09-1997",
            "ExpirationDate": "14-09-2028",
            "UpdatedDate": "09-09-2019",
            "Organization": "Google LLC",
            "State": "CA",
            "Country": "US",
            "Dnssec": "unsigned",
            "Registrar": {
                "Name": "MarkMonitor, Inc."
            },
            "Emails": [
                "abusecomplaints@markmonitor.com",
                "whoisrequest@markmonitor.com"
            ],
            "NameServers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ],
            "DomainStatus": [
                "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
                "clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
                "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited",
                "serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited",
                "serverTransferProhibited https://icann.org/epp#serverTransferProhibited",
                "serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited",
                "clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)",
                "clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)",
                "clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)",
                "serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)",
                "serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)",
                "serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)"
            ],
            "FeedRelatedIndicators": [
                {
                    "Type": "email",
                    "Value": "abusecomplaints@markmonitor.com"
                },
                {
                    "Type": "email",
                    "Value": "whoisrequest@markmonitor.com"
                }
            ],
            "Raw": "domain_name: ['GOOGLE.COM', 'google.com'], registrar: MarkMonitor, Inc., whois_server: whois.markmonitor.com, referral_url: None, updated_date: [datetime.datetime(2019, 9, 9, 15, 39, 4), datetime.datetime(2019, 9, 9, 15, 39, 4, tzinfo=datetime.timezone.utc)], creation_date: [datetime.datetime(1997, 9, 15, 4, 0), datetime.datetime(1997, 9, 15, 7, 0, tzinfo=datetime.timezone.utc)], expiration_date: [datetime.datetime(2028, 9, 14, 4, 0), datetime.datetime(2028, 9, 13, 7, 0, tzinfo=datetime.timezone.utc)], name_servers: ['NS1.GOOGLE.COM', 'NS2.GOOGLE.COM', 'NS3.GOOGLE.COM', 'NS4.GOOGLE.COM', 'ns4.google.com', 'ns3.google.com', 'ns1.google.com', 'ns2.google.com'], status: ['clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited', 'clientTransferProhibited https://icann.org/epp#clientTransferProhibited', 'clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited', 'serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited', 'serverTransferProhibited https://icann.org/epp#serverTransferProhibited', 'serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited', 'clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)', 'clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)', 'clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)', 'serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)', 'serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)', 'serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)'], emails: ['abusecomplaints@markmonitor.com', 'whoisrequest@markmonitor.com'], dnssec: unsigned, name: None, org: Google LLC, address: None, city: None, state: CA, registrant_postal_code: None, country: US"
        },
        "Name": "google.com",
        "WhoisServer": "whois.markmonitor.com",
        "CreationDate": "15-09-1997",
        "ExpirationDate": "14-09-2028",
        "UpdatedDate": "09-09-2019",
        "Organization": "Google LLC",
        "State": "CA",
        "Country": "US",
        "Dnssec": "unsigned",
        "Registrar": {
            "Name": "MarkMonitor, Inc."
        },
        "Emails": [
            "abusecomplaints@markmonitor.com",
            "whoisrequest@markmonitor.com"
        ],
        "NameServers": [
            "ns1.google.com",
            "ns2.google.com",
            "ns3.google.com",
            "ns4.google.com"
        ],
        "DomainStatus": [
            "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
            "clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
            "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited",
            "serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited",
            "serverTransferProhibited https://icann.org/epp#serverTransferProhibited",
            "serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited",
            "clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)",
            "clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)",
            "clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)",
            "serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)",
            "serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)",
            "serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)"
        ],
        "FeedRelatedIndicators": [
            {
                "Type": "email",
                "Value": "abusecomplaints@markmonitor.com"
            },
            {
                "Type": "email",
                "Value": "whoisrequest@markmonitor.com"
            }
        ],
        "Raw": "domain_name: ['GOOGLE.COM', 'google.com'], registrar: MarkMonitor, Inc., whois_server: whois.markmonitor.com, referral_url: None, updated_date: [datetime.datetime(2019, 9, 9, 15, 39, 4), datetime.datetime(2019, 9, 9, 15, 39, 4, tzinfo=datetime.timezone.utc)], creation_date: [datetime.datetime(1997, 9, 15, 4, 0), datetime.datetime(1997, 9, 15, 7, 0, tzinfo=datetime.timezone.utc)], expiration_date: [datetime.datetime(2028, 9, 14, 4, 0), datetime.datetime(2028, 9, 13, 7, 0, tzinfo=datetime.timezone.utc)], name_servers: ['NS1.GOOGLE.COM', 'NS2.GOOGLE.COM', 'NS3.GOOGLE.COM', 'NS4.GOOGLE.COM', 'ns4.google.com', 'ns3.google.com', 'ns1.google.com', 'ns2.google.com'], status: ['clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited', 'clientTransferProhibited https://icann.org/epp#clientTransferProhibited', 'clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited', 'serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited', 'serverTransferProhibited https://icann.org/epp#serverTransferProhibited', 'serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited', 'clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)', 'clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)', 'clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)', 'serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)', 'serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)', 'serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)'], emails: ['abusecomplaints@markmonitor.com', 'whoisrequest@markmonitor.com'], dnssec: unsigned, name: None, org: Google LLC, address: None, city: None, state: CA, registrant_postal_code: None, country: US"
    }
}

Human Readable Output

Whois results for google.com

Name CreationDate ExpirationDate UpdatedDate NameServers Organization Registrar DomainStatus Emails WhoisServer

google.com 15-09-1997 14-09-2028 09-09-2019 ns1.google.com,
ns2.google.com,
ns3.google.com,
ns4.google.com Google LLC Name: MarkMonitor, Inc. clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited,
clientTransferProhibited https://icann.org/epp#clientTransferProhibited,
clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited,
serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited,
serverTransferProhibited https://icann.org/epp#serverTransferProhibited,
serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited,
clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited),
clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited),
clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited),
serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited),
serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited),
serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited) abusecomplaints@markmonitor.com,
whoisrequest@markmonitor.com whois.markmonitor.com

Name	CreationDate	ExpirationDate	UpdatedDate	NameServers	Organization	Registrar	DomainStatus	Emails	WhoisServer
google.com	15-09-1997	14-09-2028	09-09-2019	ns1.google.com, ns2.google.com, ns3.google.com, ns4.google.com	Google LLC	Name: MarkMonitor, Inc.	clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited, clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited), clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited), clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited), serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited), serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited), serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)	abusecomplaints@markmonitor.com, whoisrequest@markmonitor.com	whois.markmonitor.com

ip

Provides data enrichment for ips.

Base Command

ip

Input

Argument Name	Description	Required
ip	The IP to enrich.	Required

Context Output

Path	Type	Description
Whois.IP.asn	string	Globally unique identifier used for routing information exchange with Autonomous Systems.
Whois.IP.asn_cidr	string	Network routing block assigned to an ASN.
Whois.IP.asn_country_code	string	ASN assigned country code in ISO 3166-1 format.
Whois.IP.asn_date	Date	ASN allocation date in ISO 8601 format.
Whois.IP.asn_description	string	The ASN description
Whois.IP.asn_registry	string	ASN assigned regional internet registry.
Whois.IP.entities	string	list of object names referenced by an RIR network. Map these to the objects dictionary keys.
Whois.IP.network.cidr	string	Network routing block an IP address belongs to.
Whois.IP.network.country	string	Country code registered with the RIR in ISO 3166-1 format.
Whois.IP.network.end_address	string	The last IP address in a network block.
Whois.IP.network.events.action	string	The reason for an event.
Whois.IP.network.events.actor	string	The identifier for an event initiator (if any).
Whois.IP.network.events.timestamp	Date	The date an event occurred in ISO 8601 format.
Whois.IP.network.handle	string	Unique identifier for a registered object.
Whois.IP.network.ip_version	string	IP protocol version (v4 or v6) of an IP address.
Whois.IP.network.links	string	HTTP/HTTPS links provided for an RIR object.
Whois.IP.network.name	string	The identifier assigned to the network registration for an IP address.
Whois.IP.network.notices.description	string	The description/body of a notice.
Whois.IP.network.notices.links	string	list of HTTP/HTTPS links provided for a notice.
Whois.IP.network.notices.title	string	The title/header for a notice.
Whois.IP.network.parent_handle	string	Unique identifier for the parent network of a registered network.
Whois.IP.network.remarks	string	List of remark (notice) dictionaries.
Whois.IP.network.start_address	string	The first IP address in a network block.
Whois.IP.network.status	string	List indicating the state of a registered object.
Whois.IP.network.type	string	The RIR classification of a registered network.
Whois.IP.query	string	The IP address
IP.Address	string	IP address
IP.ASN	string	The autonomous system name for the IP address, for example: “AS8948”.
IP.Geo.Country	string	The country in which the IP address is located.
IP.Organization.Name	string	The organization name.
IP.feed_related_indicators.value	string	Indicators that are associated with the IP.
IP.feed_related_indicators.type	string	The type of the indicators that are associated with the IP
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.

Command example

!ip ip=8.8.8.8

Context Example

{
    "DBotScore": {
        "Indicator": "8.8.8.8",
        "Reliability": "B - Usually reliable",
        "Score": 0,
        "Type": "ip",
        "Vendor": "Whois"
    },
    "IP": {
        "ASN": "15169",
        "Address": "8.8.8.8",
        "FeedRelatedIndicators": [
            {
                "description": null,
                "type": "CIDR",
                "value": "8.8.8.0/24"
            }
        ],
        "Organization": {
            "Name": "LVLT-GOGL-8-8-8"
        }
    },
    "Whois": {
        "IP": {
            "asn": "15169",
            "asn_cidr": "8.8.8.0/24",
            "asn_country_code": "US",
            "asn_date": "1992-12-01",
            "asn_description": "GOOGLE, US",
            "asn_registry": "arin",
            "entities": [
                "GOGL"
            ],
            "network": {
                "cidr": "8.8.8.0/24",
                "country": null,
                "end_address": "8.8.8.255",
                "events": [
                    {
                        "action": "last changed",
                        "actor": null,
                        "timestamp": "2014-03-14T16:52:05-04:00"
                    },
                    {
                        "action": "registration",
                        "actor": null,
                        "timestamp": "2014-03-14T16:52:05-04:00"
                    }
                ],
                "handle": "NET-8-8-8-0-1",
                "ip_version": "v4",
                "links": [
                    "https://rdap.arin.net/registry/ip/8.8.8.0",
                    "https://whois.arin.net/rest/net/NET-8-8-8-0-1",
                    "https://rdap.arin.net/registry/ip/8.0.0.0/9"
                ],
                "name": "LVLT-GOGL-8-8-8",
                "notices": [
                    {
                        "description": "By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use",
                        "links": [
                            "https://www.arin.net/resources/registry/whois/tou/"
                        ],
                        "title": "Terms of Service"
                    },
                    {
                        "description": "If you see inaccuracies in the results, please visit: ",
                        "links": [
                            "https://www.arin.net/resources/registry/whois/inaccuracy_reporting/"
                        ],
                        "title": "Whois Inaccuracy Reporting"
                    },
                    {
                        "description": "Copyright 1997-2022, American Registry for Internet Numbers, Ltd.",
                        "links": null,
                        "title": "Copyright Notice"
                    }
                ],
                "parent_handle": "NET-8-0-0-0-1",
                "raw": null,
                "remarks": null,
                "start_address": "8.8.8.0",
                "status": [
                    "active"
                ],
                "type": "ALLOCATION"
            },
            "nir": null,
            "objects": {
                "ABUSE5250-ARIN": {
                    "contact": {
                        "address": [
                            {
                                "type": null,
                                "value": "1600 Amphitheatre Parkway\nMountain View\nCA\n94043\nUnited States"
                            }
                        ],
                        "email": [
                            {
                                "type": null,
                                "value": "network-abuse@google.com"
                            }
                        ],
                        "kind": "group",
                        "name": "Abuse",
                        "phone": [
                            {
                                "type": [
                                    "work",
                                    "voice"
                                ],
                                "value": "+1-650-253-0000"
                            }
                        ],
                        "role": null,
                        "title": null
                    },
                    "entities": null,
                    "events": [
                        {
                            "action": "last changed",
                            "actor": null,
                            "timestamp": "2018-10-24T11:23:55-04:00"
                        },
                        {
                            "action": "registration",
                            "actor": null,
                            "timestamp": "2015-11-06T15:36:35-05:00"
                        }
                    ],
                    "events_actor": null,
                    "handle": "ABUSE5250-ARIN",
                    "links": [
                        "https://rdap.arin.net/registry/entity/ABUSE5250-ARIN",
                        "https://whois.arin.net/rest/poc/ABUSE5250-ARIN"
                    ],
                    "notices": [
                        {
                            "description": "By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use",
                            "links": [
                                "https://www.arin.net/resources/registry/whois/tou/"
                            ],
                            "title": "Terms of Service"
                        },
                        {
                            "description": "If you see inaccuracies in the results, please visit: ",
                            "links": [
                                "https://www.arin.net/resources/registry/whois/inaccuracy_reporting/"
                            ],
                            "title": "Whois Inaccuracy Reporting"
                        },
                        {
                            "description": "Copyright 1997-2022, American Registry for Internet Numbers, Ltd.",
                            "links": null,
                            "title": "Copyright Notice"
                        }
                    ],
                    "raw": null,
                    "remarks": [
                        {
                            "description": "Please note that the recommended way to file abuse complaints are located in the following links.\n\nTo report abuse and illegal activity: https://www.google.com/contact/\n\nFor legal requests: http://support.google.com/legal \n\nRegards,\nThe Google Team",
                            "links": null,
                            "title": "Registration Comments"
                        },
                        {
                            "description": "ARIN has attempted to validate the data for this POC, but has received no response from the POC since 2019-10-24",
                            "links": null,
                            "title": "Unvalidated POC"
                        }
                    ],
                    "roles": [
                        "abuse"
                    ],
                    "status": null
                },
                "GOGL": {
                    "contact": {
                        "address": [
                            {
                                "type": null,
                                "value": "1600 Amphitheatre Parkway\nMountain View\nCA\n94043\nUnited States"
                            }
                        ],
                        "email": null,
                        "kind": "org",
                        "name": "Google LLC",
                        "phone": null,
                        "role": null,
                        "title": null
                    },
                    "entities": [
                        "ABUSE5250-ARIN",
                        "ZG39-ARIN"
                    ],
                    "events": [
                        {
                            "action": "last changed",
                            "actor": null,
                            "timestamp": "2019-10-31T15:45:45-04:00"
                        },
                        {
                            "action": "registration",
                            "actor": null,
                            "timestamp": "2000-03-30T00:00:00-05:00"
                        }
                    ],
                    "events_actor": null,
                    "handle": "GOGL",
                    "links": [
                        "https://rdap.arin.net/registry/entity/GOGL",
                        "https://whois.arin.net/rest/org/GOGL"
                    ],
                    "notices": null,
                    "raw": null,
                    "remarks": [
                        {
                            "description": "Please note that the recommended way to file abuse complaints are located in the following links. \n\nTo report abuse and illegal activity: https://www.google.com/contact/\n\nFor legal requests: http://support.google.com/legal \n\nRegards, \nThe Google Team",
                            "links": null,
                            "title": "Registration Comments"
                        }
                    ],
                    "roles": [
                        "registrant"
                    ],
                    "status": null
                },
                "ZG39-ARIN": {
                    "contact": {
                        "address": [
                            {
                                "type": null,
                                "value": "1600 Amphitheatre Parkway\nMountain View\nCA\n94043\nUnited States"
                            }
                        ],
                        "email": [
                            {
                                "type": null,
                                "value": "arin-contact@google.com"
                            }
                        ],
                        "kind": "group",
                        "name": "Google LLC",
                        "phone": [
                            {
                                "type": [
                                    "work",
                                    "voice"
                                ],
                                "value": "+1-650-253-0000"
                            }
                        ],
                        "role": null,
                        "title": null
                    },
                    "entities": null,
                    "events": [
                        {
                            "action": "last changed",
                            "actor": null,
                            "timestamp": "2021-11-10T10:26:54-05:00"
                        },
                        {
                            "action": "registration",
                            "actor": null,
                            "timestamp": "2000-11-30T13:54:08-05:00"
                        }
                    ],
                    "events_actor": null,
                    "handle": "ZG39-ARIN",
                    "links": [
                        "https://rdap.arin.net/registry/entity/ZG39-ARIN",
                        "https://whois.arin.net/rest/poc/ZG39-ARIN"
                    ],
                    "notices": [
                        {
                            "description": "By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use",
                            "links": [
                                "https://www.arin.net/resources/registry/whois/tou/"
                            ],
                            "title": "Terms of Service"
                        },
                        {
                            "description": "If you see inaccuracies in the results, please visit: ",
                            "links": [
                                "https://www.arin.net/resources/registry/whois/inaccuracy_reporting/"
                            ],
                            "title": "Whois Inaccuracy Reporting"
                        },
                        {
                            "description": "Copyright 1997-2022, American Registry for Internet Numbers, Ltd.",
                            "links": null,
                            "title": "Copyright Notice"
                        }
                    ],
                    "raw": null,
                    "remarks": null,
                    "roles": [
                        "technical",
                        "administrative"
                    ],
                    "status": [
                        "validated"
                    ]
                }
            },
            "query": "8.8.8.8",
            "raw": null
        }
    }
}

Human Readable Output

Whois results

asn asn_cidr asn_date country_code network_name query

15169 8.8.8.0/24 1992-12-01 LVLT-GOGL-8-8-8 8.8.8.8

asn	asn_cidr	asn_date	country_code	network_name	query
15169	8.8.8.0/24	1992-12-01		LVLT-GOGL-8-8-8	8.8.8.8

Troubleshooting

Bad Gateway (502) error when using a firewall or proxy.
- This occurs when the WHOIS Top-Level Domain (TLD) provider is not reachable through the configured firewall or proxy.
- Resolution: Add the relevant WHOIS TLD provider to your firewall or proxy allowlist.
Connection timeout errors when running in a FedRAMP High environment.
- The Whois integration connects to external WHOIS servers over TCP port 43. On FedRAMP High tenants, outbound traffic from engines is only permitted on port 443, so port 43 connections are blocked and the integration times out. For more information, refer to the documentation on outbound engine IPs for Cortex XSOAR SaaS and Cortex XSIAM.
- Resolution: Configure a SOCKS5 proxy in the Proxy URL field (for example, socks5h://your-proxy-host:1080) that is reachable on port 443 and can forward traffic to external WHOIS servers on port 43. Note that this proxy setting affects all commands except the ip command. A standard HTTP proxy is not sufficient, as most HTTP proxies do not support the CONNECT method on non-standard ports such as port 43.
Rate-limiting or IP blocking errors when querying WHOIS servers.
- This can occur when multiple users or systems make requests from the same IP address, causing the WHOIS server to block or throttle queries.
- Resolution: Use a dedicated engine or a SOCKS5 proxy for WHOIS queries to provide a unique outbound IP address and avoid shared-IP blocking.

Known limitations

The IP lookup has a rate limit of 1 lookup per second.

Configuration parameters

with_error — Return Errors
proxy_url — Proxy URL
proxy — Use system proxy settings
old-version — Use legacy context
integrationReliability — Source Reliability (required)
rate_limit_retry_count — Rate Limit Retry Count
rate_limit_wait_seconds — Rate Limit Wait Seconds
rate_limit_errors_suppressed — Suppress Rate Limit errors

Commands (3)

domain
Provides data enrichment for domains.
ip
Provides data enrichment for ips.
whois
Provides data enrichment for domains using free resources. Availability of those services may be limited.

Source

Whois.py Whois_test.py Whois.yml Whois_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: Whois
  version: -1
configuration:
- display: Return Errors
  name: with_error
  type: 8
  section: Connect
  advanced: true
  required: false
  additionalinfo: If set, failed command results will be returned as warnings instead of errors.
- display: Proxy URL
  additionalinfo: "Supports socks4/socks5/http connect proxies (e.g. socks5h://host:1080). Will effect all commands except for the `ip` command."
  name: proxy_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  additionalinfo: "Effect the `ip` command and the other commands only if the Proxy URL is not set."
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
  hidden: false
- additionalinfo: Get the Legacy output of context data for 'whois' and 'domain' commands.
  display: Use legacy context
  name: old-version
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: The number of times to try when getting a Rate Limit response.
  defaultvalue: '0'
  display: Rate Limit Retry Count
  name: rate_limit_retry_count
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: The number of seconds to wait each iteration when getting a Rate Limit response.
  defaultvalue: '120'
  display: Rate Limit Wait Seconds
  name: rate_limit_wait_seconds
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Suppress Rate Limit errors
  additionalinfo: "Whether Rate Limit errors should be supressed or not."
  defaultvalue: "false"
  name: rate_limit_errors_suppressed
  type: 8
  section: Collect
  advanced: true
  required: false
description: Provides data enrichment for domains.
display: Whois
name: Whois
script:
  commands:
  - arguments:
    - description: The domain to enrich.
      isArray: true
      name: query
      required: true
    - name: recursive
      description: Whether to get the raw response from the whois servers recursively. Default value is True.
      defaultValue: true
    - name: verbose
      description: Whether to add the raw response as a dictionary to the context. Default value is False.
      defaultValue: false
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    description: Provides data enrichment for domains using free resources. Availability of those services may be limited.
    name: whois
    outputs:
    - contextPath: DBotScore.Score
      description: The actual score.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Domain.Name
      description: The domain name.
      type: string
    - contextPath: Domain.DomainStatus
      description: The domain status.
      type: string
    - contextPath: Domain.Dnssec
      description: The domain name system security extension (DNSSEC).
      type: string
    - contextPath: Domain.NameServers
      description: The name servers.
      type: string
    - contextPath: Domain.Country
      description: The domain country.
      type: string
    - contextPath: Domain.State
      description: The domain state.
      type: string
    - contextPath: Domain.City
      description: The domain city.
      type: string
    - contextPath: Domain.CreationDate
      description: The date that the domain was created (UTC). 
      type: date
    - contextPath: Domain.UpdatedDate
      description: The date that the domain was last updated (UTC).
      type: date
    - contextPath: Domain.ExpirationDate
      description: The date that the domain expires (UTC).
      type: date
    - contextPath: Domain.Registrar.Name
      description: The name of the registrar.
      type: string
    - contextPath: Domain.Registrar.Address
      description: The address of the registrar.
      type: string
    - contextPath: Domain.Registrar.Email
      description: The email of the registrar.
      type: string
    - contextPath: Domain.Registrar.Id
      description: The ID of the registrar.
      type: string
    - contextPath: Domain.Registrar.Phone
      description: The phone of the registrar.
      type: string
    - contextPath: Domain.Registrar.Url
      description: The URL of the registrar.
      type: string
    - contextPath: Domain.Registrar.AbuseEmail
      description: The email address of the contact for reporting abuse.
      type: string
    - contextPath: Domain.Emails
      description: The abuse emails.
      type: string
    - contextPath: Domain.Address
      description: The abuse address.
      type: string
    - contextPath: Domain.Organization
      description: The organization domain name.
      type: string
    - contextPath: Domain.WhoisServer
      description: The whois server name.
      type: string
    - contextPath: Domain.Phone
      description: The phone number of the tech administrator.
      type: string
    - contextPath: Domain.Admin
      description: Administrator information.
      type: object
    - contextPath: Domain.Admin.Address
      description: The address of the administrator.
      type: string
    - contextPath: Domain.Admin.ApplicationPurpose
      description: The application purpose of the administrator.
      type: string
    - contextPath: Domain.Admin.C
      description: The C field of the administrator.
      type: string
    - contextPath: Domain.Admin.City
      description: The city of the administrator.
      type: string
    - contextPath: Domain.Admin.Country
      description: The country of the administrator.
      type: string
    - contextPath: Domain.Admin.Email
      description: The email address of the administrator.
      type: string
    - contextPath: Domain.Admin.Fax
      description: The fax number of the administrator.
      type: string
    - contextPath: Domain.Admin.FaxExt
      description: The fax extension of the administrator.
      type: string
    - contextPath: Domain.Admin.Id
      description: The ID of the administrator.
      type: string
    - contextPath: Domain.Admin.Name
      description: The name of the administrator.
      type: string
    - contextPath: Domain.Admin.Org
      description: The organization name of the administrator.
      type: string
    - contextPath: Domain.Admin.Phone
      description: The phone number of the administrator.
      type: string
    - contextPath: Domain.Admin.PhoneExt
      description: The phone extension of the administrator.
      type: string
    - contextPath: Domain.Admin.PostalCode
      description: The postal code of the administrator.
      type: string
    - contextPath: Domain.Admin.State
      description: The state of the administrator.
      type: string
    - contextPath: Domain.Admin.StateProvince
      description: The state or province of the administrator.
      type: string
    - contextPath: Domain.Admin.Street
      description: The street of the administrator.
      type: string
    - contextPath: Domain.Registrant.Name
      description: The name of the registrant.
      type: string
    - contextPath: Domain.Registrant.Email
      description: The email address of the registrant.
      type: string
    - contextPath: Domain.Registrant.Country
      description: The country of the registrant.
      type: string
    - contextPath: Domain.Registrant.State
      description: The state of the registrant.
      type: string
    - contextPath: Domain.Registrant.Org
      description: The organization of the registrant.
      type: string
    - contextPath: Domain.Registrant.Organization
      description: The organization of the registrant.
      type: string
    - contextPath: Domain.Registrant.PostalCode
      description: The postal code of the registrant.
      type: string
    - contextPath: Domain.Registrant.Street
      description: The street of the registrant.
      type: string
    - contextPath: Domain.Registrant.Phone
      description: The phone number of the registrant.
      type: string
    - contextPath: Domain.Registrant.City
      description: The city of the registrant.
      type: string
    - contextPath: Domain.Registrant.Address
      description: The address of the registrant.
      type: string
    - contextPath: Domain.Registrant.ContactName
      description: The contact name of the registrant.
      type: string
    - contextPath: Domain.Registrant.Fax
      description: The fax of the registrant.
      type: string
    - contextPath: Domain.Registrant.Id
      description: The ID of the registrant.
      type: string
    - contextPath: Domain.Registrant.Number
      description: The number of the registrant.
      type: string
    - contextPath: Domain.Registrant.StateProvince
      description: The state province of the registrant.
      type: string
    - contextPath: Domain.Raw
      description: The raw output from python-whois lib.
      type: string
    - contextPath: Domain.Administrator
      description: The country of the domain administrator.
      type: string
    - contextPath: Domain.Tech.Name
      description: The name of the tech contact.
      type: string
    - contextPath: Domain.Tech.Address
      description: The address of the tech contact.
      type: string
    - contextPath: Domain.Tech.City
      description: The city of the tech contact.
      type: string
    - contextPath: Domain.Tech.Country
      description: The country of the tech contact.
      type: string
    - contextPath: Domain.Tech.Email
      description: The email address of the tech contact.
      type: string
    - contextPath: Domain.Tech.Fax
      description: The fax number of the tech contact.
      type: string
    - contextPath: Domain.Tech.ID
      description: The ID of the tech contact.
      type: string
    - contextPath: Domain.Tech.Org
      description: The organization of the tech contact.
      type: string
    - contextPath: Domain.Tech.Organization
      description: The organization of the tech contact.
      type: string
    - contextPath: Domain.Tech.Phone
      description: The phone number of the tech contact.
      type: string
    - contextPath: Domain.Tech.PostalCode
      description: The postal code of the tech contact.
      type: string
    - contextPath: Domain.Tech.State
      description: The state of the tech contact.
      type: string
    - contextPath: Domain.Tech.StateProvince
      description: The state/province of the tech contact.
      type: string
    - contextPath: Domain.Tech.Street
      description: The street of the tech contact.
      type: string
    - contextPath: Domain.ID
      description: The ID of the domain.
      type: string
    - contextPath: Domain.WHOIS.Name
      description: The domain name.
      type: string
    - contextPath: Domain.WHOIS.DomainStatus
      description: The domain status.
      type: string
    - contextPath: Domain.WHOIS.Dnssec
      description: The domain name system security extension (DNSSEC).
      type: string
    - contextPath: Domain.WHOIS.NameServers
      description: The name servers.
      type: string
    - contextPath: Domain.WHOIS.Country
      description: The domain country.
      type: string
    - contextPath: Domain.WHOIS.State
      description: The domain state.
      type: string
    - contextPath: Domain.WHOIS.City
      description: The domain city.
      type: string
    - contextPath: Domain.WHOIS.CreationDate
      description: The date that the domain was created (UTC). 
      type: date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: The date that the domain was last updated (UTC).
      type: date
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The date that the domain expires (UTC).
      type: date
    - contextPath: Domain.WHOIS.Registrar.Name
      description: The name of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Address
      description: The address of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Email
      description: The email of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Id
      description: The ID of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Phone
      description: The phone of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Url
      description: The URL of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.AbuseEmail
      description: The email address of the contact for reporting abuse.
      type: string
    - contextPath: Domain.WHOIS.Emails
      description: The abuse emails.
      type: string
    - contextPath: Domain.WHOIS.Address
      description: The abuse address.
      type: string
    - contextPath: Domain.WHOIS.Organization
      description: The organization domain name.
      type: string
    - contextPath: Domain.WHOIS.WhoisServer
      description: The whois server name.
      type: string
    - contextPath: Domain.WHOIS.Phone
      description: The phone number of the tech administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin
      description: Administrator information.
      type: object
    - contextPath: Domain.WHOIS.Admin.Address
      description: The address of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.ApplicationPurpose
      description: The application purpose of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.C
      description: The C field of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.City
      description: The city of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Country
      description: The country of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Email
      description: The email address of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Fax
      description: The fax number of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.FaxExt
      description: The fax extension of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Id
      description: The ID of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Name
      description: The name of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Org
      description: The organization of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Org
      description: The organization name of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Phone
      description: The phone number of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.PhoneExt
      description: The phone extension of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.PostalCode
      description: The postal code of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.State
      description: The state of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.StateProvince
      description: The state or province of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Street
      description: The street of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Name
      description: The name of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Email
      description: The email address of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Country
      description: The country of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.State
      description: The state of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Org
      description: The organization of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.PostalCode
      description: The postal code of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Street
      description: The street of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Phone
      description: The phone number of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.City
      description: The city of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Address
      description: The address of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.ContactName
      description: The contact name of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Fax
      description: The fax of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Id
      description: The ID of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Number
      description: The number of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.StateProvince
      description: The state province of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Raw
      description: The raw output from python-whois lib.
      type: string
    - contextPath: Domain.WHOIS.Administrator
      description: The country of the domain administrator.
      type: string
    - contextPath: Domain.WHOIS.Tech.Name
      description: The name of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Address
      description: The address of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.City
      description: The city of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Country
      description: The country of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Email
      description: The email address of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Fax
      description: The fax number of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.ID
      description: The ID of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Org
      description: The organization of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Phone
      description: The phone number of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.PostalCode
      description: The postal code of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.State
      description: The state of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.StateProvince
      description: The state/province of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Street
      description: The street of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.ID
      description: The ID of the domain.
      type: string
    - contextPath: Domain.FeedRelatedIndicators.Type
      description: Indicators that are associated with the domain.
      type: String
    - contextPath: Domain.FeedRelatedIndicators.Value
      description: The type of the indicators that are associated with the domain.
      type: String
    - contextPath: Domain.WHOIS.FeedRelatedIndicators.Type
      description: Indicators that are associated with the domain.
      type: String
    - contextPath: Domain.WHOIS.FeedRelatedIndicators.Value
      description: The type of the indicators that are associated with the domain.
      type: String
    - contextPath: Domain.FeedRelatedIndicators.type
      description: (Legacy output) Indicators that are associated with the domain.
      type: String
    - contextPath: Domain.FeedRelatedIndicators.value
      description: (Legacy output) The type of the indicators that are associated with the domain.
      type: String
    - contextPath: Domain.Whois.Name
      description: (Legacy output) The domain name.
      type: string
    - contextPath: Domain.Whois.DomainStatus
      description: (Legacy output) The domain status.
      type: string
    - contextPath: Domain.Whois.DNSSec
      description: (Legacy output) The domain name system security extension (DNSSEC).
      type: string
    - contextPath: Domain.Whois.NameServers
      description: (Legacy output) The name servers.
      type: string
    - contextPath: Domain.Whois.CreationDate
      description: (Legacy output) The date that the domain was created (UTC). 
      type: date
    - contextPath: Domain.Whois.UpdatedDate
      description: (Legacy output)The date that the domain was last updated (UTC).
      type: date
    - contextPath: Domain.Whois.ExpirationDate
      description: (Legacy output)The date that the domain expires (UTC).
      type: date
    - contextPath: Domain.Whois.Registrar.Name
      description: (Legacy output)The name of the registrar.
      type: string
    - contextPath: Domain.Whois.Emails
      description: (Legacy output)The abuse emails.
      type: string
    - contextPath: Domain.Whois.Registrar.AbuseEmail
      description: (Legacy output) The email address of the contact for reporting abuse.
      type: string
    - contextPath: Domain.Whois.Registrant.name
      description: (Legacy output) The name of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.email
      description: (Legacy output) The email address of the registrant.
      type: string
    - contextPath: Domain.Whois.Raw
      description: (Legacy output) The raw output.
      type: string
    - contextPath: Domain.Whois.Administrator.country
      description: (Legacy output) The country of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.name
      description: (Legacy output) The name of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.state
      description: (Legacy output) The state of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.email
      description: (Legacy output) The email address of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.organization
      description: (Legacy output) The organization of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.postalcode
      description: (Legacy output) The postal code of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.street
      description: (Legacy output) The street of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.phone
      description: (Legacy output) The phone number of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.city
      description: (Legacy output) The city of the domain administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.country
      description: (Legacy output) The country of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.name
      description: (Legacy output) The name of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.state
      description: (Legacy output) The state of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.email
      description: (Legacy output) The email address of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.organization
      description: (Legacy output) The organization of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.postalcode
      description: (Legacy output) The postal code of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.street
      description: (Legacy output) The street of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.phone
      description: (Legacy output) The phone number of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.city
      description: (Legacy output) The city of the tech administrator.
      type: string
    - contextPath: Domain.Whois.Registrant.country
      description: (Legacy output) The country of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.state
      description: (Legacy output) The state of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.organization
      description: (Legacy output) The organization of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.postalcode
      description: (Legacy output) The postal code of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.street
      description: (Legacy output) The street of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.phone
      description: (Legacy output) The phone number of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.city
      description: (Legacy output) The city of the registrant.
      type: string
    - contextPath: Domain.Whois.ID
      description: (Legacy output) The ID of the domain.
      type: string
    - contextPath: Domain.Whois.QueryStatus
      description: (Legacy output) The result of the command ("Success" or "Failed").
      type: string
    - contextPath: Domain.Whois.QueryValue
      description: (Legacy output) The query requested by the user.
      type: string
    - contextPath: Domain.Whois.QueryResult
      description: (Legacy output) Whether the query found a matching result.
      type: Boolean
  - arguments:
    - default: true
      description: The domain to enrich.
      isArray: true
      name: domain
      required: true
    - name: recursive
      description: Whether to get the raw response from the whois servers recursively. Default value is True.
      defaultValue: true
    description: Provides data enrichment for domains.
    name: domain
    outputs:
    - contextPath: DBotScore.Score
      description: The actual score.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Domain.Name
      description: The domain name.
      type: string
    - contextPath: Domain.DomainStatus
      description: The domain status.
      type: String
    - contextPath: Domain.ExpirationDate
      description: The date that the domain expires (UTC).
      type: Date
    - contextPath: Domain.NameServers
      description: The name servers.
      type: String
    - contextPath: Domain.Organization
      description: The organization name.
      type: String
    - contextPath: Domain.ID
      description: The ID of the domain.
      type: string
    - contextPath: Domain.UpdatedDate
      description: The date that the domain was last updated (UTC).
      type: Date
    - contextPath: Domain.Dnssec
      description: The domain name system security extension (DNSSEC).
      type: string
    - contextPath: Domain.Country
      description: The domain country.
      type: string
    - contextPath: Domain.State
      description: The domain state.
      type: string
    - contextPath: Domain.City
      description: The domain city.
      type: string
    - contextPath: Domain.CreationDate
      description: The date that the domain was created (UTC). 
      type: date
    - contextPath: Domain.Registrar.Name
      description: The name of the registrar.
      type: string
    - contextPath: Domain.Registrar.Address
      description: The address of the registrar.
      type: string
    - contextPath: Domain.Registrar.Email
      description: The email of the registrar.
      type: string
    - contextPath: Domain.Registrar.Id
      description: The ID of the registrar.
      type: string
    - contextPath: Domain.Registrar.Phone
      description: The phone number of the registrar.
      type: string
    - contextPath: Domain.Registrar.Url
      description: The URL of the registrar.
      type: string
    - contextPath: Domain.Registrar.AbuseEmail
      description: The email address of the contact for reporting abuse.
      type: string
    - contextPath: Domain.Emails
      description: The abuse emails.
      type: string
    - contextPath: Domain.Address
      description: The abuse address.
      type: string
    - contextPath: Domain.WhoisServer
      description: The whois server name.
      type: string
    - contextPath: Domain.Phone
      description: The phone number of the tech administrator.
      type: string
    - contextPath: Domain.Admin
      description: Administrator information.
      type: object
    - contextPath: Domain.Admin.Address
      description: The address of the administrator.
      type: string
    - contextPath: Domain.Admin.ApplicationPurpose
      description: The application purpose of the administrator.
      type: string
    - contextPath: Domain.Admin.C
      description: The C field of the administrator.
      type: string
    - contextPath: Domain.Admin.City
      description: The city of the administrator.
      type: string
    - contextPath: Domain.Admin.Country
      description: The country of the administrator.
      type: string
    - contextPath: Domain.Admin.Email
      description: The email address of the administrator.
      type: string
    - contextPath: Domain.Admin.Fax
      description: The fax number of the administrator.
      type: string
    - contextPath: Domain.Admin.FaxExt
      description: The fax extension of the administrator.
      type: string
    - contextPath: Domain.Admin.Id
      description: The ID of the administrator.
      type: string
    - contextPath: Domain.Admin.Name
      description: The name of the administrator.
      type: string
    - contextPath: Domain.Admin.Org
      description: The organization of the administrator.
      type: string
    - contextPath: Domain.Admin.Phone
      description: The phone number of the administrator.
      type: string
    - contextPath: Domain.Admin.PhoneExt
      description: The phone extension of the administrator.
      type: string
    - contextPath: Domain.Admin.PostalCode
      description: The postal code of the administrator.
      type: string
    - contextPath: Domain.Admin.State
      description: The state of the administrator.
      type: string
    - contextPath: Domain.Admin.StateProvince
      description: The state or province of the administrator.
      type: string
    - contextPath: Domain.Admin.Street
      description: The street of the administrator.
      type: string
    - contextPath: Domain.Registrant.Name
      description: The name of the registrant.
      type: string
    - contextPath: Domain.Registrant.Email
      description: The email address of the registrant.
      type: string
    - contextPath: Domain.Registrant.Country
      description: The country of the registrant.
      type: string
    - contextPath: Domain.Registrant.State
      description: The state of the registrant.
      type: string
    - contextPath: Domain.Registrant.Org
      description: The organization of the registrant.
      type: string
    - contextPath: Domain.Registrant.Organization
      description: The organization of the registrant.
      type: string
    - contextPath: Domain.Registrant.PostalCode
      description: The postal code of the registrant.
      type: string
    - contextPath: Domain.Registrant.Street
      description: The street of the registrant.
      type: string
    - contextPath: Domain.Registrant.Phone
      description: The phone number of the registrant.
      type: string
    - contextPath: Domain.Registrant.City
      description: The city of the registrant.
      type: string
    - contextPath: Domain.Registrant.Address
      description: The address of the registrant.
      type: string
    - contextPath: Domain.Registrant.ContactName
      description: The contact name of the registrant.
      type: string
    - contextPath: Domain.Registrant.Fax
      description: The fax of the registrant.
      type: string
    - contextPath: Domain.Registrant.Id
      description: The ID of the registrant.
      type: string
    - contextPath: Domain.Registrant.Number
      description: The number of the registrant.
      type: string
    - contextPath: Domain.Registrant.StateProvince
      description: The state province of the registrant.
      type: string
    - contextPath: Domain.Raw
      description: The raw output from python-whois lib.
      type: string
    - contextPath: Domain.Administrator
      description: The country of the domain administrator.
      type: string
    - contextPath: Domain.Tech.Name
      description: The name of the tech contact.
      type: string
    - contextPath: Domain.Tech.Address
      description: The address of the tech contact.
      type: string
    - contextPath: Domain.Tech.City
      description: The city of the tech contact.
      type: string
    - contextPath: Domain.Tech.Country
      description: The country of the tech contact.
      type: string
    - contextPath: Domain.Tech.Email
      description: The email address of the tech contact.
      type: string
    - contextPath: Domain.Tech.Fax
      description: The fax number of the tech contact.
      type: string
    - contextPath: Domain.Tech.ID
      description: The ID of the tech contact.
      type: string
    - contextPath: Domain.Tech.Org
      description: The organization of the tech contact.
      type: string
    - contextPath: Domain.Tech.Organization
      description: The organization of the tech contact.
      type: string
    - contextPath: Domain.Tech.Phone
      description: The phone number of the tech contact.
      type: string
    - contextPath: Domain.Tech.PostalCode
      description: The postal code of the tech contact.
      type: string
    - contextPath: Domain.Tech.State
      description: The state of the tech contact.
      type: string
    - contextPath: Domain.Tech.StateProvince
      description: The state/province of the tech contact.
      type: string
    - contextPath: Domain.Tech.Street
      description: The street of the tech contact.
      type: string
    - contextPath: Domain.FeedRelatedIndicators.Type
      description: Indicators that are associated with the domain.
      type: String
    - contextPath: Domain.FeedRelatedIndicators.Value
      description: The type of the indicators that are associated with the domain.
      type: String
    - contextPath: Domain.WHOIS.FeedRelatedIndicators.Type
      description: Indicators that are associated with the domain.
      type: String
    - contextPath: Domain.WHOIS.FeedRelatedIndicators.Value
      description: The type of the indicators that are associated with the domain.
      type: String
    - contextPath: Domain.WHOIS.Name
      description: The domain name.
      type: string
    - contextPath: Domain.WHOIS.ID
      description: The ID of the domain.
      type: string
    - contextPath: Domain.WHOIS.DomainStatus
      description: The domain status.
      type: string
    - contextPath: Domain.WHOIS.Dnssec
      description: The domain name system security extension (DNSSEC).
      type: string
    - contextPath: Domain.WHOIS.NameServers
      description: The name servers.
      type: string
    - contextPath: Domain.WHOIS.Country
      description: The domain country.
      type: string
    - contextPath: Domain.WHOIS.State
      description: The domain state.
      type: string
    - contextPath: Domain.WHOIS.City
      description: The domain city.
      type: string
    - contextPath: Domain.WHOIS.CreationDate
      description: The date that the domain was created (UTC). 
      type: date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: The date that the domain was last updated (UTC).
      type: date
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The date that the domain expires (UTC).
      type: date
    - contextPath: Domain.WHOIS.Registrar.Name
      description: The name of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Address
      description: The address of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Email
      description: The email of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Id
      description: The ID of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Phone
      description: The phone number of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.Url
      description: The URL of the registrar.
      type: string
    - contextPath: Domain.WHOIS.Registrar.AbuseEmail
      description: The email address of the contact for reporting abuse.
      type: string
    - contextPath: Domain.WHOIS.Emails
      description: The abuse emails.
      type: string
    - contextPath: Domain.WHOIS.Address
      description: The abuse address.
      type: string
    - contextPath: Domain.WHOIS.Organization
      description: The organization domain name.
      type: string
    - contextPath: Domain.WHOIS.WhoisServer
      description: The whois server name.
      type: string
    - contextPath: Domain.WHOIS.Phone
      description: The phone number of the tech administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin
      description: Administrator information.
      type: object
    - contextPath: Domain.WHOIS.Admin.Address
      description: The address of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.ApplicationPurpose
      description: The application purpose of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.C
      description: The C field of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.City
      description: The city of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Country
      description: The country of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Email
      description: The email address of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Fax
      description: The fax number of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.FaxExt
      description: The fax extension of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Id
      description: The ID of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Name
      description: The name of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Org
      description: The organization of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Org
      description: The organization name of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Phone
      description: The phone number of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.PhoneExt
      description: The phone extension of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.PostalCode
      description: The postal code of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.State
      description: The state of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.StateProvince
      description: The state or province of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Admin.Street
      description: The street of the administrator.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Name
      description: The name of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Email
      description: The email address of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Country
      description: The country of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.State
      description: The state of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Org
      description: The organization of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.PostalCode
      description: The postal code of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Street
      description: The street of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Phone
      description: The phone number of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.City
      description: The city of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Address
      description: The address of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.ContactName
      description: The contact name of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Fax
      description: The fax of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Id
      description: The ID of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.Number
      description: The number of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Registrant.StateProvince
      description: The state province of the registrant.
      type: string
    - contextPath: Domain.WHOIS.Raw
      description: The raw output from python-whois lib.
      type: string
    - contextPath: Domain.WHOIS.Administrator
      description: The country of the domain administrator.
      type: string
    - contextPath: Domain.WHOIS.Tech.Name
      description: The name of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Address
      description: The address of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.City
      description: The city of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Country
      description: The country of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Email
      description: The email address of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Fax
      description: The fax number of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.ID
      description: The ID of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Org
      description: The organization of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Phone
      description: The phone number of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.PostalCode
      description: The postal code of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.State
      description: The state of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.StateProvince
      description: The state/province of the tech contact.
      type: string
    - contextPath: Domain.WHOIS.Tech.Street
      description: The street of the tech contact.
      type: string
    - contextPath: Domain.Whois.Name
      description: (Legacy output) The domain name.
      type: string
    - contextPath: Domain.Whois.DomainStatus
      description: (Legacy output) The domain status.
      type: string
    - contextPath: Domain.Whois.DNSSec
      description: (Legacy output) The domain name system security extension (DNSSEC).
      type: string
    - contextPath: Domain.Whois.NameServers
      description: (Legacy output) The name servers.
      type: string
    - contextPath: Domain.Whois.CreationDate
      description: (Legacy output) The date that the domain was created (UTC).
      type: date
    - contextPath: Domain.Whois.UpdatedDate
      description: (Legacy output) The date that the domain was last updated (UTC).
      type: date
    - contextPath: Domain.Whois.ExpirationDate
      description: (Legacy output) The date that the domain expires (UTC).
      type: date
    - contextPath: Domain.Whois.Registrar.Name
      description: (Legacy output) The name of the registrar.
      type: string
    - contextPath: Domain.Whois.Emails
      description: (Legacy output) The abuse emails.
      type: string
    - contextPath: Domain.Whois.Registrar.AbuseEmail
      description: (Legacy output) The email address of the contact for reporting abuse.
      type: string
    - contextPath: Domain.Whois.Registrant.name
      description: (Legacy output) The name of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.email
      description: (Legacy output) The email address of the registrant.
      type: string
    - contextPath: Domain.Whois.Raw
      description: (Legacy output) The raw output.
      type: string
    - contextPath: Domain.Whois.Administrator.country
      description: (Legacy output) The country of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.name
      description: (Legacy output) The name of domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.state
      description: (Legacy output) The state of domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.email
      description: (Legacy output) The email address of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.organization
      description: (Legacy output) The organization of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.postalcode
      description: (Legacy output) The postal code of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.street
      description: (Legacy output) The street of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.phone
      description: (Legacy output) The phone number of the domain administrator.
      type: string
    - contextPath: Domain.Whois.Administrator.city
      description: (Legacy output) The city of the domain administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.country
      description: (Legacy output) The country of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.name
      description: (Legacy output) The name of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.state
      description: (Legacy output) The state of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.email
      description: (Legacy output) The email address of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.organization
      description: (Legacy output) The organization of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.postalcode
      description: (Legacy output) The postal code of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.street
      description: (Legacy output) The street of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.phone
      description: (Legacy output) The phone number of the tech administrator.
      type: string
    - contextPath: Domain.Whois.TechAdmin.city
      description: (Legacy output) The city of the tech administrator.
      type: string
    - contextPath: Domain.Whois.Registrant.country
      description: (Legacy output) The country of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.state
      description: (Legacy output) The state of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.organization
      description: (Legacy output) The organization of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.postalcode
      description: (Legacy output) The postal code of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.street
      description: (Legacy output) The street of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.phone
      description: (Legacy output) The phone number of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.city
      description: (Legacy output) The city of the registrant.
      type: string
    - contextPath: Domain.Whois.ID
      description: (Legacy output) The ID of the domain.
      type: string
    - contextPath: Domain.Whois.QueryStatus
      description: (Legacy output) The result of the command ("Success" or "Failed").
      type: string
    - contextPath: Domain.Whois.QueryResult
      description: (Legacy output) Whether the query found a matching result.
      type: Boolean
    - contextPath: Domain.Admin.Country
      description: (Legacy output) The country of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Name
      description: (Legacy output) The name of domain administrator.
      type: String
    - contextPath: Domain.Admin.State
      description: (Legacy output) The state of domain administrator.
      type: String
    - contextPath: Domain.Admin.country
      description: (Legacy output) The country of the domain administrator.
      type: String
    - contextPath: Domain.Admin.name
      description: (Legacy output) The name of domain administrator.
      type: String
    - contextPath: Domain.Admin.state
      description: (Legacy output) The state of domain administrator.
      type: String
    - contextPath: Domain.Registrant.country
      description: (Legacy output) The country of the registrant.
      type: String
    - contextPath: Domain.Registrant.organization
      description: (Legacy output) The organization of the registrant.
      type: String
    - contextPath: Domain.Registrant.state
      description: (Legacy output) The state of the registrant.
      type: String
    - contextPath: Domain.FeedRelatedIndicators.type
      description: (Legacy output) Indicators that are associated with the domain.
      type: String
    - contextPath: Domain.FeedRelatedIndicators.value
      description: (Legacy output) The type of the indicators that are associated with the domain.
      type: String
  - arguments:
    - default: true
      description: The IP to enrich.
      isArray: true
      name: ip
      required: true
    - description: 'The number of times to try when getting a Rate Limit response.'
      defaultValue: 0
      name: rate_limit_retry_count
    - description: 'The number of seconds to wait each iteration when getting a Rate Limit response.'
      defaultValue: 120
      name: rate_limit_wait_seconds
    - description: 'Whether Rate Limit errors should be suppressed or not.'
      defaultValue: 'false'
      name: rate_limit_errors_suppressed
    description: Provides data enrichment for ips.
    name: ip
    outputs:
    - contextPath: Whois.IP.asn
      description: Globally unique identifier used for routing information exchange with Autonomous Systems.
      type: string
    - contextPath: Whois.IP.asn_cidr
      description: Network routing block assigned to an ASN.
      type: string
    - contextPath: Whois.IP.asn_country_code
      description: ASN assigned country code in ISO 3166-1 format.
      type: string
    - contextPath: Whois.IP.asn_date
      description: ASN allocation date in ISO 8601 format.
      type: Date
    - contextPath: Whois.IP.asn_description
      description: The ASN description.
      type: string
    - contextPath: Whois.IP.asn_registry
      description: ASN assigned regional internet registry.
      type: string
    - contextPath: Whois.IP.entities
      description: list of object names referenced by an RIR network. Map these to the objects dictionary keys.
      type: string
    - contextPath: Whois.IP.network.cidr
      description: Network routing block an IP address belongs to.
      type: string
    - contextPath: Whois.IP.network.country
      description: Country code registered with the RIR in ISO 3166-1 format.
      type: string
    - contextPath: Whois.IP.network.end_address
      description: The last IP address in a network block.
      type: string
    - contextPath: Whois.IP.network.events.action
      description: The reason for an event.
      type: string
    - contextPath: Whois.IP.network.events.actor
      description: The identifier for an event initiator (if any).
      type: string
    - contextPath: Whois.IP.network.events.timestamp
      description: The date an event occurred in ISO 8601 format.
      type: Date
    - contextPath: Whois.IP.network.handle
      description: Unique identifier for a registered object.
      type: string
    - contextPath: Whois.IP.network.ip_version
      description: IP protocol version (v4 or v6) of an IP address.
      type: string
    - contextPath: Whois.IP.network.links
      description: HTTP/HTTPS links provided for an RIR object.
      type: string
    - contextPath: Whois.IP.network.name
      description: The identifier assigned to the network registration for an IP address.
      type: string
    - contextPath: Whois.IP.network.notices.description
      description: The description/body of a notice.
      type: string
    - contextPath: Whois.IP.network.notices.links
      description: list of HTTP/HTTPS links provided for a notice.
      type: string
    - contextPath: Whois.IP.network.notices.title
      description: The title/header for a notice.
      type: string
    - contextPath: Whois.IP.network.parent_handle
      description: Unique identifier for the parent network of a registered network.
      type: string
    - contextPath: Whois.IP.network.remarks
      description: List of remark (notice) dictionaries.
      type: string
    - contextPath: Whois.IP.network.start_address
      description: The first IP address in a network block.
      type: string
    - contextPath: Whois.IP.network.status
      description: List indicating the state of a registered object.
      type: string
    - contextPath: Whois.IP.network.type
      description: The RIR classification of a registered network.
      type: string
    - contextPath: Whois.IP.query
      description: The IP address.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948".'
      type: string
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: string
    - contextPath: IP.Organization.Name
      description: The organization name.
      type: string
    - contextPath: IP.feed_related_indicators.value
      description: Indicators that are associated with the IP.
      type: string
    - contextPath: IP.feed_related_indicators.type
      description: The type of the indicators that are associated with the IP.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
  dockerimage: demisto/ippysocks-py3:1.0.0.11195141
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- whois_test
- Whois A new layout implemented with python-whois service
fromversion: 5.0.0
defaultEnabled: false