category: Data Enrichment & Threat Intelligence provider: Open Source sectionorder: - Connect - Collect commonfields: id: Whois version: -1 configuration: - display: Return Errors name: with_error type: 8 section: Connect advanced: true required: false additionalinfo: If set, failed command results will be returned as warnings instead of errors. - display: Proxy URL additionalinfo: "Supports socks4/socks5/http connect proxies (e.g. socks5h://host:1080). Will effect all commands except for the `ip` command." name: proxy_url type: 0 section: Connect advanced: true required: false - display: Use system proxy settings additionalinfo: "Effect the `ip` command and the other commands only if the Proxy URL is not set." name: proxy type: 8 section: Connect advanced: true required: false hidden: false - additionalinfo: Get the Legacy output of context data for 'whois' and 'domain' commands. display: Use legacy context name: old-version type: 8 section: Collect advanced: true required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect - additionalinfo: The number of times to try when getting a Rate Limit response. defaultvalue: '0' display: Rate Limit Retry Count name: rate_limit_retry_count type: 0 section: Collect advanced: true required: false - additionalinfo: The number of seconds to wait each iteration when getting a Rate Limit response. defaultvalue: '120' display: Rate Limit Wait Seconds name: rate_limit_wait_seconds type: 0 section: Collect advanced: true required: false - display: Suppress Rate Limit errors additionalinfo: "Whether Rate Limit errors should be supressed or not." defaultvalue: "false" name: rate_limit_errors_suppressed type: 8 section: Collect advanced: true required: false description: Provides data enrichment for domains. display: Whois name: Whois script: commands: - arguments: - description: The domain to enrich. isArray: true name: query required: true - name: recursive description: Whether to get the raw response from the whois servers recursively. Default value is True. defaultValue: true - name: verbose description: Whether to add the raw response as a dictionary to the context. Default value is False. defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' description: Provides data enrichment for domains using free resources. Availability of those services may be limited. name: whois outputs: - contextPath: DBotScore.Score description: The actual score. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: Domain.Name description: The domain name. type: string - contextPath: Domain.DomainStatus description: The domain status. type: string - contextPath: Domain.Dnssec description: The domain name system security extension (DNSSEC). type: string - contextPath: Domain.NameServers description: The name servers. type: string - contextPath: Domain.Country description: The domain country. type: string - contextPath: Domain.State description: The domain state. type: string - contextPath: Domain.City description: The domain city. type: string - contextPath: Domain.CreationDate description: The date that the domain was created (UTC). type: date - contextPath: Domain.UpdatedDate description: The date that the domain was last updated (UTC). type: date - contextPath: Domain.ExpirationDate description: The date that the domain expires (UTC). type: date - contextPath: Domain.Registrar.Name description: The name of the registrar. type: string - contextPath: Domain.Registrar.Address description: The address of the registrar. type: string - contextPath: Domain.Registrar.Email description: The email of the registrar. type: string - contextPath: Domain.Registrar.Id description: The ID of the registrar. type: string - contextPath: Domain.Registrar.Phone description: The phone of the registrar. type: string - contextPath: Domain.Registrar.Url description: The URL of the registrar. type: string - contextPath: Domain.Registrar.AbuseEmail description: The email address of the contact for reporting abuse. type: string - contextPath: Domain.Emails description: The abuse emails. type: string - contextPath: Domain.Address description: The abuse address. type: string - contextPath: Domain.Organization description: The organization domain name. type: string - contextPath: Domain.WhoisServer description: The whois server name. type: string - contextPath: Domain.Phone description: The phone number of the tech administrator. type: string - contextPath: Domain.Admin description: Administrator information. type: object - contextPath: Domain.Admin.Address description: The address of the administrator. type: string - contextPath: Domain.Admin.ApplicationPurpose description: The application purpose of the administrator. type: string - contextPath: Domain.Admin.C description: The C field of the administrator. type: string - contextPath: Domain.Admin.City description: The city of the administrator. type: string - contextPath: Domain.Admin.Country description: The country of the administrator. type: string - contextPath: Domain.Admin.Email description: The email address of the administrator. type: string - contextPath: Domain.Admin.Fax description: The fax number of the administrator. type: string - contextPath: Domain.Admin.FaxExt description: The fax extension of the administrator. type: string - contextPath: Domain.Admin.Id description: The ID of the administrator. type: string - contextPath: Domain.Admin.Name description: The name of the administrator. type: string - contextPath: Domain.Admin.Org description: The organization name of the administrator. type: string - contextPath: Domain.Admin.Phone description: The phone number of the administrator. type: string - contextPath: Domain.Admin.PhoneExt description: The phone extension of the administrator. type: string - contextPath: Domain.Admin.PostalCode description: The postal code of the administrator. type: string - contextPath: Domain.Admin.State description: The state of the administrator. type: string - contextPath: Domain.Admin.StateProvince description: The state or province of the administrator. type: string - contextPath: Domain.Admin.Street description: The street of the administrator. type: string - contextPath: Domain.Registrant.Name description: The name of the registrant. type: string - contextPath: Domain.Registrant.Email description: The email address of the registrant. type: string - contextPath: Domain.Registrant.Country description: The country of the registrant. type: string - contextPath: Domain.Registrant.State description: The state of the registrant. type: string - contextPath: Domain.Registrant.Org description: The organization of the registrant. type: string - contextPath: Domain.Registrant.Organization description: The organization of the registrant. type: string - contextPath: Domain.Registrant.PostalCode description: The postal code of the registrant. type: string - contextPath: Domain.Registrant.Street description: The street of the registrant. type: string - contextPath: Domain.Registrant.Phone description: The phone number of the registrant. type: string - contextPath: Domain.Registrant.City description: The city of the registrant. type: string - contextPath: Domain.Registrant.Address description: The address of the registrant. type: string - contextPath: Domain.Registrant.ContactName description: The contact name of the registrant. type: string - contextPath: Domain.Registrant.Fax description: The fax of the registrant. type: string - contextPath: Domain.Registrant.Id description: The ID of the registrant. type: string - contextPath: Domain.Registrant.Number description: The number of the registrant. type: string - contextPath: Domain.Registrant.StateProvince description: The state province of the registrant. type: string - contextPath: Domain.Raw description: The raw output from python-whois lib. type: string - contextPath: Domain.Administrator description: The country of the domain administrator. type: string - contextPath: Domain.Tech.Name description: The name of the tech contact. type: string - contextPath: Domain.Tech.Address description: The address of the tech contact. type: string - contextPath: Domain.Tech.City description: The city of the tech contact. type: string - contextPath: Domain.Tech.Country description: The country of the tech contact. type: string - contextPath: Domain.Tech.Email description: The email address of the tech contact. type: string - contextPath: Domain.Tech.Fax description: The fax number of the tech contact. type: string - contextPath: Domain.Tech.ID description: The ID of the tech contact. type: string - contextPath: Domain.Tech.Org description: The organization of the tech contact. type: string - contextPath: Domain.Tech.Organization description: The organization of the tech contact. type: string - contextPath: Domain.Tech.Phone description: The phone number of the tech contact. type: string - contextPath: Domain.Tech.PostalCode description: The postal code of the tech contact. type: string - contextPath: Domain.Tech.State description: The state of the tech contact. type: string - contextPath: Domain.Tech.StateProvince description: The state/province of the tech contact. type: string - contextPath: Domain.Tech.Street description: The street of the tech contact. type: string - contextPath: Domain.ID description: The ID of the domain. type: string - contextPath: Domain.WHOIS.Name description: The domain name. type: string - contextPath: Domain.WHOIS.DomainStatus description: The domain status. type: string - contextPath: Domain.WHOIS.Dnssec description: The domain name system security extension (DNSSEC). type: string - contextPath: Domain.WHOIS.NameServers description: The name servers. type: string - contextPath: Domain.WHOIS.Country description: The domain country. type: string - contextPath: Domain.WHOIS.State description: The domain state. type: string - contextPath: Domain.WHOIS.City description: The domain city. type: string - contextPath: Domain.WHOIS.CreationDate description: The date that the domain was created (UTC). type: date - contextPath: Domain.WHOIS.UpdatedDate description: The date that the domain was last updated (UTC). type: date - contextPath: Domain.WHOIS.ExpirationDate description: The date that the domain expires (UTC). type: date - contextPath: Domain.WHOIS.Registrar.Name description: The name of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Address description: The address of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Email description: The email of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Id description: The ID of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Phone description: The phone of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Url description: The URL of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.AbuseEmail description: The email address of the contact for reporting abuse. type: string - contextPath: Domain.WHOIS.Emails description: The abuse emails. type: string - contextPath: Domain.WHOIS.Address description: The abuse address. type: string - contextPath: Domain.WHOIS.Organization description: The organization domain name. type: string - contextPath: Domain.WHOIS.WhoisServer description: The whois server name. type: string - contextPath: Domain.WHOIS.Phone description: The phone number of the tech administrator. type: string - contextPath: Domain.WHOIS.Admin description: Administrator information. type: object - contextPath: Domain.WHOIS.Admin.Address description: The address of the administrator. type: string - contextPath: Domain.WHOIS.Admin.ApplicationPurpose description: The application purpose of the administrator. type: string - contextPath: Domain.WHOIS.Admin.C description: The C field of the administrator. type: string - contextPath: Domain.WHOIS.Admin.City description: The city of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Country description: The country of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Email description: The email address of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Fax description: The fax number of the administrator. type: string - contextPath: Domain.WHOIS.Admin.FaxExt description: The fax extension of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Id description: The ID of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Name description: The name of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Org description: The organization of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Org description: The organization name of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Phone description: The phone number of the administrator. type: string - contextPath: Domain.WHOIS.Admin.PhoneExt description: The phone extension of the administrator. type: string - contextPath: Domain.WHOIS.Admin.PostalCode description: The postal code of the administrator. type: string - contextPath: Domain.WHOIS.Admin.State description: The state of the administrator. type: string - contextPath: Domain.WHOIS.Admin.StateProvince description: The state or province of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Street description: The street of the administrator. type: string - contextPath: Domain.WHOIS.Registrant.Name description: The name of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Email description: The email address of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Country description: The country of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.State description: The state of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Org description: The organization of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.PostalCode description: The postal code of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Street description: The street of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Phone description: The phone number of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.City description: The city of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Address description: The address of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.ContactName description: The contact name of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Fax description: The fax of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Id description: The ID of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Number description: The number of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.StateProvince description: The state province of the registrant. type: string - contextPath: Domain.WHOIS.Raw description: The raw output from python-whois lib. type: string - contextPath: Domain.WHOIS.Administrator description: The country of the domain administrator. type: string - contextPath: Domain.WHOIS.Tech.Name description: The name of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Address description: The address of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.City description: The city of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Country description: The country of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Email description: The email address of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Fax description: The fax number of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.ID description: The ID of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Org description: The organization of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Phone description: The phone number of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.PostalCode description: The postal code of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.State description: The state of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.StateProvince description: The state/province of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Street description: The street of the tech contact. type: string - contextPath: Domain.WHOIS.ID description: The ID of the domain. type: string - contextPath: Domain.FeedRelatedIndicators.Type description: Indicators that are associated with the domain. type: String - contextPath: Domain.FeedRelatedIndicators.Value description: The type of the indicators that are associated with the domain. type: String - contextPath: Domain.WHOIS.FeedRelatedIndicators.Type description: Indicators that are associated with the domain. type: String - contextPath: Domain.WHOIS.FeedRelatedIndicators.Value description: The type of the indicators that are associated with the domain. type: String - contextPath: Domain.FeedRelatedIndicators.type description: (Legacy output) Indicators that are associated with the domain. type: String - contextPath: Domain.FeedRelatedIndicators.value description: (Legacy output) The type of the indicators that are associated with the domain. type: String - contextPath: Domain.Whois.Name description: (Legacy output) The domain name. type: string - contextPath: Domain.Whois.DomainStatus description: (Legacy output) The domain status. type: string - contextPath: Domain.Whois.DNSSec description: (Legacy output) The domain name system security extension (DNSSEC). type: string - contextPath: Domain.Whois.NameServers description: (Legacy output) The name servers. type: string - contextPath: Domain.Whois.CreationDate description: (Legacy output) The date that the domain was created (UTC). type: date - contextPath: Domain.Whois.UpdatedDate description: (Legacy output)The date that the domain was last updated (UTC). type: date - contextPath: Domain.Whois.ExpirationDate description: (Legacy output)The date that the domain expires (UTC). type: date - contextPath: Domain.Whois.Registrar.Name description: (Legacy output)The name of the registrar. type: string - contextPath: Domain.Whois.Emails description: (Legacy output)The abuse emails. type: string - contextPath: Domain.Whois.Registrar.AbuseEmail description: (Legacy output) The email address of the contact for reporting abuse. type: string - contextPath: Domain.Whois.Registrant.name description: (Legacy output) The name of the registrant. type: string - contextPath: Domain.Whois.Registrant.email description: (Legacy output) The email address of the registrant. type: string - contextPath: Domain.Whois.Raw description: (Legacy output) The raw output. type: string - contextPath: Domain.Whois.Administrator.country description: (Legacy output) The country of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.name description: (Legacy output) The name of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.state description: (Legacy output) The state of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.email description: (Legacy output) The email address of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.organization description: (Legacy output) The organization of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.postalcode description: (Legacy output) The postal code of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.street description: (Legacy output) The street of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.phone description: (Legacy output) The phone number of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.city description: (Legacy output) The city of the domain administrator. type: string - contextPath: Domain.Whois.TechAdmin.country description: (Legacy output) The country of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.name description: (Legacy output) The name of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.state description: (Legacy output) The state of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.email description: (Legacy output) The email address of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.organization description: (Legacy output) The organization of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.postalcode description: (Legacy output) The postal code of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.street description: (Legacy output) The street of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.phone description: (Legacy output) The phone number of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.city description: (Legacy output) The city of the tech administrator. type: string - contextPath: Domain.Whois.Registrant.country description: (Legacy output) The country of the registrant. type: string - contextPath: Domain.Whois.Registrant.state description: (Legacy output) The state of the registrant. type: string - contextPath: Domain.Whois.Registrant.organization description: (Legacy output) The organization of the registrant. type: string - contextPath: Domain.Whois.Registrant.postalcode description: (Legacy output) The postal code of the registrant. type: string - contextPath: Domain.Whois.Registrant.street description: (Legacy output) The street of the registrant. type: string - contextPath: Domain.Whois.Registrant.phone description: (Legacy output) The phone number of the registrant. type: string - contextPath: Domain.Whois.Registrant.city description: (Legacy output) The city of the registrant. type: string - contextPath: Domain.Whois.ID description: (Legacy output) The ID of the domain. type: string - contextPath: Domain.Whois.QueryStatus description: (Legacy output) The result of the command ("Success" or "Failed"). type: string - contextPath: Domain.Whois.QueryValue description: (Legacy output) The query requested by the user. type: string - contextPath: Domain.Whois.QueryResult description: (Legacy output) Whether the query found a matching result. type: Boolean - arguments: - default: true description: The domain to enrich. isArray: true name: domain required: true - name: recursive description: Whether to get the raw response from the whois servers recursively. Default value is True. defaultValue: true description: Provides data enrichment for domains. name: domain outputs: - contextPath: DBotScore.Score description: The actual score. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: Domain.Name description: The domain name. type: string - contextPath: Domain.DomainStatus description: The domain status. type: String - contextPath: Domain.ExpirationDate description: The date that the domain expires (UTC). type: Date - contextPath: Domain.NameServers description: The name servers. type: String - contextPath: Domain.Organization description: The organization name. type: String - contextPath: Domain.ID description: The ID of the domain. type: string - contextPath: Domain.UpdatedDate description: The date that the domain was last updated (UTC). type: Date - contextPath: Domain.Dnssec description: The domain name system security extension (DNSSEC). type: string - contextPath: Domain.Country description: The domain country. type: string - contextPath: Domain.State description: The domain state. type: string - contextPath: Domain.City description: The domain city. type: string - contextPath: Domain.CreationDate description: The date that the domain was created (UTC). type: date - contextPath: Domain.Registrar.Name description: The name of the registrar. type: string - contextPath: Domain.Registrar.Address description: The address of the registrar. type: string - contextPath: Domain.Registrar.Email description: The email of the registrar. type: string - contextPath: Domain.Registrar.Id description: The ID of the registrar. type: string - contextPath: Domain.Registrar.Phone description: The phone number of the registrar. type: string - contextPath: Domain.Registrar.Url description: The URL of the registrar. type: string - contextPath: Domain.Registrar.AbuseEmail description: The email address of the contact for reporting abuse. type: string - contextPath: Domain.Emails description: The abuse emails. type: string - contextPath: Domain.Address description: The abuse address. type: string - contextPath: Domain.WhoisServer description: The whois server name. type: string - contextPath: Domain.Phone description: The phone number of the tech administrator. type: string - contextPath: Domain.Admin description: Administrator information. type: object - contextPath: Domain.Admin.Address description: The address of the administrator. type: string - contextPath: Domain.Admin.ApplicationPurpose description: The application purpose of the administrator. type: string - contextPath: Domain.Admin.C description: The C field of the administrator. type: string - contextPath: Domain.Admin.City description: The city of the administrator. type: string - contextPath: Domain.Admin.Country description: The country of the administrator. type: string - contextPath: Domain.Admin.Email description: The email address of the administrator. type: string - contextPath: Domain.Admin.Fax description: The fax number of the administrator. type: string - contextPath: Domain.Admin.FaxExt description: The fax extension of the administrator. type: string - contextPath: Domain.Admin.Id description: The ID of the administrator. type: string - contextPath: Domain.Admin.Name description: The name of the administrator. type: string - contextPath: Domain.Admin.Org description: The organization of the administrator. type: string - contextPath: Domain.Admin.Phone description: The phone number of the administrator. type: string - contextPath: Domain.Admin.PhoneExt description: The phone extension of the administrator. type: string - contextPath: Domain.Admin.PostalCode description: The postal code of the administrator. type: string - contextPath: Domain.Admin.State description: The state of the administrator. type: string - contextPath: Domain.Admin.StateProvince description: The state or province of the administrator. type: string - contextPath: Domain.Admin.Street description: The street of the administrator. type: string - contextPath: Domain.Registrant.Name description: The name of the registrant. type: string - contextPath: Domain.Registrant.Email description: The email address of the registrant. type: string - contextPath: Domain.Registrant.Country description: The country of the registrant. type: string - contextPath: Domain.Registrant.State description: The state of the registrant. type: string - contextPath: Domain.Registrant.Org description: The organization of the registrant. type: string - contextPath: Domain.Registrant.Organization description: The organization of the registrant. type: string - contextPath: Domain.Registrant.PostalCode description: The postal code of the registrant. type: string - contextPath: Domain.Registrant.Street description: The street of the registrant. type: string - contextPath: Domain.Registrant.Phone description: The phone number of the registrant. type: string - contextPath: Domain.Registrant.City description: The city of the registrant. type: string - contextPath: Domain.Registrant.Address description: The address of the registrant. type: string - contextPath: Domain.Registrant.ContactName description: The contact name of the registrant. type: string - contextPath: Domain.Registrant.Fax description: The fax of the registrant. type: string - contextPath: Domain.Registrant.Id description: The ID of the registrant. type: string - contextPath: Domain.Registrant.Number description: The number of the registrant. type: string - contextPath: Domain.Registrant.StateProvince description: The state province of the registrant. type: string - contextPath: Domain.Raw description: The raw output from python-whois lib. type: string - contextPath: Domain.Administrator description: The country of the domain administrator. type: string - contextPath: Domain.Tech.Name description: The name of the tech contact. type: string - contextPath: Domain.Tech.Address description: The address of the tech contact. type: string - contextPath: Domain.Tech.City description: The city of the tech contact. type: string - contextPath: Domain.Tech.Country description: The country of the tech contact. type: string - contextPath: Domain.Tech.Email description: The email address of the tech contact. type: string - contextPath: Domain.Tech.Fax description: The fax number of the tech contact. type: string - contextPath: Domain.Tech.ID description: The ID of the tech contact. type: string - contextPath: Domain.Tech.Org description: The organization of the tech contact. type: string - contextPath: Domain.Tech.Organization description: The organization of the tech contact. type: string - contextPath: Domain.Tech.Phone description: The phone number of the tech contact. type: string - contextPath: Domain.Tech.PostalCode description: The postal code of the tech contact. type: string - contextPath: Domain.Tech.State description: The state of the tech contact. type: string - contextPath: Domain.Tech.StateProvince description: The state/province of the tech contact. type: string - contextPath: Domain.Tech.Street description: The street of the tech contact. type: string - contextPath: Domain.FeedRelatedIndicators.Type description: Indicators that are associated with the domain. type: String - contextPath: Domain.FeedRelatedIndicators.Value description: The type of the indicators that are associated with the domain. type: String - contextPath: Domain.WHOIS.FeedRelatedIndicators.Type description: Indicators that are associated with the domain. type: String - contextPath: Domain.WHOIS.FeedRelatedIndicators.Value description: The type of the indicators that are associated with the domain. type: String - contextPath: Domain.WHOIS.Name description: The domain name. type: string - contextPath: Domain.WHOIS.ID description: The ID of the domain. type: string - contextPath: Domain.WHOIS.DomainStatus description: The domain status. type: string - contextPath: Domain.WHOIS.Dnssec description: The domain name system security extension (DNSSEC). type: string - contextPath: Domain.WHOIS.NameServers description: The name servers. type: string - contextPath: Domain.WHOIS.Country description: The domain country. type: string - contextPath: Domain.WHOIS.State description: The domain state. type: string - contextPath: Domain.WHOIS.City description: The domain city. type: string - contextPath: Domain.WHOIS.CreationDate description: The date that the domain was created (UTC). type: date - contextPath: Domain.WHOIS.UpdatedDate description: The date that the domain was last updated (UTC). type: date - contextPath: Domain.WHOIS.ExpirationDate description: The date that the domain expires (UTC). type: date - contextPath: Domain.WHOIS.Registrar.Name description: The name of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Address description: The address of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Email description: The email of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Id description: The ID of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Phone description: The phone number of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.Url description: The URL of the registrar. type: string - contextPath: Domain.WHOIS.Registrar.AbuseEmail description: The email address of the contact for reporting abuse. type: string - contextPath: Domain.WHOIS.Emails description: The abuse emails. type: string - contextPath: Domain.WHOIS.Address description: The abuse address. type: string - contextPath: Domain.WHOIS.Organization description: The organization domain name. type: string - contextPath: Domain.WHOIS.WhoisServer description: The whois server name. type: string - contextPath: Domain.WHOIS.Phone description: The phone number of the tech administrator. type: string - contextPath: Domain.WHOIS.Admin description: Administrator information. type: object - contextPath: Domain.WHOIS.Admin.Address description: The address of the administrator. type: string - contextPath: Domain.WHOIS.Admin.ApplicationPurpose description: The application purpose of the administrator. type: string - contextPath: Domain.WHOIS.Admin.C description: The C field of the administrator. type: string - contextPath: Domain.WHOIS.Admin.City description: The city of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Country description: The country of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Email description: The email address of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Fax description: The fax number of the administrator. type: string - contextPath: Domain.WHOIS.Admin.FaxExt description: The fax extension of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Id description: The ID of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Name description: The name of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Org description: The organization of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Org description: The organization name of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Phone description: The phone number of the administrator. type: string - contextPath: Domain.WHOIS.Admin.PhoneExt description: The phone extension of the administrator. type: string - contextPath: Domain.WHOIS.Admin.PostalCode description: The postal code of the administrator. type: string - contextPath: Domain.WHOIS.Admin.State description: The state of the administrator. type: string - contextPath: Domain.WHOIS.Admin.StateProvince description: The state or province of the administrator. type: string - contextPath: Domain.WHOIS.Admin.Street description: The street of the administrator. type: string - contextPath: Domain.WHOIS.Registrant.Name description: The name of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Email description: The email address of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Country description: The country of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.State description: The state of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Org description: The organization of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.PostalCode description: The postal code of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Street description: The street of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Phone description: The phone number of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.City description: The city of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Address description: The address of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.ContactName description: The contact name of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Fax description: The fax of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Id description: The ID of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.Number description: The number of the registrant. type: string - contextPath: Domain.WHOIS.Registrant.StateProvince description: The state province of the registrant. type: string - contextPath: Domain.WHOIS.Raw description: The raw output from python-whois lib. type: string - contextPath: Domain.WHOIS.Administrator description: The country of the domain administrator. type: string - contextPath: Domain.WHOIS.Tech.Name description: The name of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Address description: The address of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.City description: The city of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Country description: The country of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Email description: The email address of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Fax description: The fax number of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.ID description: The ID of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Org description: The organization of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Phone description: The phone number of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.PostalCode description: The postal code of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.State description: The state of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.StateProvince description: The state/province of the tech contact. type: string - contextPath: Domain.WHOIS.Tech.Street description: The street of the tech contact. type: string - contextPath: Domain.Whois.Name description: (Legacy output) The domain name. type: string - contextPath: Domain.Whois.DomainStatus description: (Legacy output) The domain status. type: string - contextPath: Domain.Whois.DNSSec description: (Legacy output) The domain name system security extension (DNSSEC). type: string - contextPath: Domain.Whois.NameServers description: (Legacy output) The name servers. type: string - contextPath: Domain.Whois.CreationDate description: (Legacy output) The date that the domain was created (UTC). type: date - contextPath: Domain.Whois.UpdatedDate description: (Legacy output) The date that the domain was last updated (UTC). type: date - contextPath: Domain.Whois.ExpirationDate description: (Legacy output) The date that the domain expires (UTC). type: date - contextPath: Domain.Whois.Registrar.Name description: (Legacy output) The name of the registrar. type: string - contextPath: Domain.Whois.Emails description: (Legacy output) The abuse emails. type: string - contextPath: Domain.Whois.Registrar.AbuseEmail description: (Legacy output) The email address of the contact for reporting abuse. type: string - contextPath: Domain.Whois.Registrant.name description: (Legacy output) The name of the registrant. type: string - contextPath: Domain.Whois.Registrant.email description: (Legacy output) The email address of the registrant. type: string - contextPath: Domain.Whois.Raw description: (Legacy output) The raw output. type: string - contextPath: Domain.Whois.Administrator.country description: (Legacy output) The country of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.name description: (Legacy output) The name of domain administrator. type: string - contextPath: Domain.Whois.Administrator.state description: (Legacy output) The state of domain administrator. type: string - contextPath: Domain.Whois.Administrator.email description: (Legacy output) The email address of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.organization description: (Legacy output) The organization of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.postalcode description: (Legacy output) The postal code of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.street description: (Legacy output) The street of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.phone description: (Legacy output) The phone number of the domain administrator. type: string - contextPath: Domain.Whois.Administrator.city description: (Legacy output) The city of the domain administrator. type: string - contextPath: Domain.Whois.TechAdmin.country description: (Legacy output) The country of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.name description: (Legacy output) The name of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.state description: (Legacy output) The state of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.email description: (Legacy output) The email address of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.organization description: (Legacy output) The organization of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.postalcode description: (Legacy output) The postal code of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.street description: (Legacy output) The street of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.phone description: (Legacy output) The phone number of the tech administrator. type: string - contextPath: Domain.Whois.TechAdmin.city description: (Legacy output) The city of the tech administrator. type: string - contextPath: Domain.Whois.Registrant.country description: (Legacy output) The country of the registrant. type: string - contextPath: Domain.Whois.Registrant.state description: (Legacy output) The state of the registrant. type: string - contextPath: Domain.Whois.Registrant.organization description: (Legacy output) The organization of the registrant. type: string - contextPath: Domain.Whois.Registrant.postalcode description: (Legacy output) The postal code of the registrant. type: string - contextPath: Domain.Whois.Registrant.street description: (Legacy output) The street of the registrant. type: string - contextPath: Domain.Whois.Registrant.phone description: (Legacy output) The phone number of the registrant. type: string - contextPath: Domain.Whois.Registrant.city description: (Legacy output) The city of the registrant. type: string - contextPath: Domain.Whois.ID description: (Legacy output) The ID of the domain. type: string - contextPath: Domain.Whois.QueryStatus description: (Legacy output) The result of the command ("Success" or "Failed"). type: string - contextPath: Domain.Whois.QueryResult description: (Legacy output) Whether the query found a matching result. type: Boolean - contextPath: Domain.Admin.Country description: (Legacy output) The country of the domain administrator. type: String - contextPath: Domain.Admin.Name description: (Legacy output) The name of domain administrator. type: String - contextPath: Domain.Admin.State description: (Legacy output) The state of domain administrator. type: String - contextPath: Domain.Admin.country description: (Legacy output) The country of the domain administrator. type: String - contextPath: Domain.Admin.name description: (Legacy output) The name of domain administrator. type: String - contextPath: Domain.Admin.state description: (Legacy output) The state of domain administrator. type: String - contextPath: Domain.Registrant.country description: (Legacy output) The country of the registrant. type: String - contextPath: Domain.Registrant.organization description: (Legacy output) The organization of the registrant. type: String - contextPath: Domain.Registrant.state description: (Legacy output) The state of the registrant. type: String - contextPath: Domain.FeedRelatedIndicators.type description: (Legacy output) Indicators that are associated with the domain. type: String - contextPath: Domain.FeedRelatedIndicators.value description: (Legacy output) The type of the indicators that are associated with the domain. type: String - arguments: - default: true description: The IP to enrich. isArray: true name: ip required: true - description: 'The number of times to try when getting a Rate Limit response.' defaultValue: 0 name: rate_limit_retry_count - description: 'The number of seconds to wait each iteration when getting a Rate Limit response.' defaultValue: 120 name: rate_limit_wait_seconds - description: 'Whether Rate Limit errors should be suppressed or not.' defaultValue: 'false' name: rate_limit_errors_suppressed description: Provides data enrichment for ips. name: ip outputs: - contextPath: Whois.IP.asn description: Globally unique identifier used for routing information exchange with Autonomous Systems. type: string - contextPath: Whois.IP.asn_cidr description: Network routing block assigned to an ASN. type: string - contextPath: Whois.IP.asn_country_code description: ASN assigned country code in ISO 3166-1 format. type: string - contextPath: Whois.IP.asn_date description: ASN allocation date in ISO 8601 format. type: Date - contextPath: Whois.IP.asn_description description: The ASN description. type: string - contextPath: Whois.IP.asn_registry description: ASN assigned regional internet registry. type: string - contextPath: Whois.IP.entities description: list of object names referenced by an RIR network. Map these to the objects dictionary keys. type: string - contextPath: Whois.IP.network.cidr description: Network routing block an IP address belongs to. type: string - contextPath: Whois.IP.network.country description: Country code registered with the RIR in ISO 3166-1 format. type: string - contextPath: Whois.IP.network.end_address description: The last IP address in a network block. type: string - contextPath: Whois.IP.network.events.action description: The reason for an event. type: string - contextPath: Whois.IP.network.events.actor description: The identifier for an event initiator (if any). type: string - contextPath: Whois.IP.network.events.timestamp description: The date an event occurred in ISO 8601 format. type: Date - contextPath: Whois.IP.network.handle description: Unique identifier for a registered object. type: string - contextPath: Whois.IP.network.ip_version description: IP protocol version (v4 or v6) of an IP address. type: string - contextPath: Whois.IP.network.links description: HTTP/HTTPS links provided for an RIR object. type: string - contextPath: Whois.IP.network.name description: The identifier assigned to the network registration for an IP address. type: string - contextPath: Whois.IP.network.notices.description description: The description/body of a notice. type: string - contextPath: Whois.IP.network.notices.links description: list of HTTP/HTTPS links provided for a notice. type: string - contextPath: Whois.IP.network.notices.title description: The title/header for a notice. type: string - contextPath: Whois.IP.network.parent_handle description: Unique identifier for the parent network of a registered network. type: string - contextPath: Whois.IP.network.remarks description: List of remark (notice) dictionaries. type: string - contextPath: Whois.IP.network.start_address description: The first IP address in a network block. type: string - contextPath: Whois.IP.network.status description: List indicating the state of a registered object. type: string - contextPath: Whois.IP.network.type description: The RIR classification of a registered network. type: string - contextPath: Whois.IP.query description: The IP address. type: string - contextPath: IP.Address description: IP address. type: string - contextPath: IP.ASN description: 'The autonomous system name for the IP address, for example: "AS8948".' type: string - contextPath: IP.Geo.Country description: The country in which the IP address is located. type: string - contextPath: IP.Organization.Name description: The organization name. type: string - contextPath: IP.feed_related_indicators.value description: Indicators that are associated with the IP. type: string - contextPath: IP.feed_related_indicators.type description: The type of the indicators that are associated with the IP. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String dockerimage: demisto/ippysocks-py3:1.0.0.11195141 runonce: false script: '-' subtype: python3 type: python tests: - whois_test - Whois A new layout implemented with python-whois service fromversion: 5.0.0 defaultEnabled: false