Time Table

WHOIS is an important source of information for many kinds of Internet observation, including threat intelligence, incident response, and attack surface discovery, and it remains widely used even now that its successor, RDAP, has arrived.

However, WHOIS responses are intended to be read by humans, and field names and record structures vary endlessly across TLDs and registries. As a result, machine processing of WHOIS has been extremely difficult, to the point that WHOIS has been called a darkness, a swamp, and a labyrinth.

Various parsers have been developed from before 2000 to the present, but all of them are ad hoc implementations that work only in very limited situations.

We therefore systematically analyzed WHOIS responses collected from all 875 TLDs that support WHOIS, up to 100 per TLD. As a result, we found that the TLDs can be organized into eight strategies, and based on this classification we developed vwhois, a practical parser built with LLM assistance. vwhois covers every TLD for which WHOIS responses were observed, parses the information contained in the responses, extracts all fields, and stores them in a unified schema.

In this presentation, we will demonstrate the evaluation method used during the tool’s development as well as vwhois in action, and explain that comprehensive WHOIS parsing is possible for nearly all domains.