Here's something to play with.
I have a script, which was written some time ago, which runs as a BBEdit
Perl Filter. It takes a list of domains/IP addresses and passes them
through a whois proxy server.
It has some limitations however.
The proxy "whois.geektools.com" limits the number of queries per day to 50.
It is quite easy using this script to RAPIDLY exceed that limit. The proxy
itself often times has a lot of users, and its connection to external
resources can go down from time to time.
Here is the script:
#!/usr/bin/perl -wnl
sub BEGIN {
use IO::Socket;
$host = "whois.geektools.com";
$| = 1;
}
$sock = new IO::Socket::INET(PeerAddr => $host,
PeerPort => 43,
Proto => 'tcp');
die "IO::Socket::INET $!" unless $sock;
print $sock "$_";
print $sock "\x0A\x0D";
while(defined($line = <$sock>))
{
$line =~ tr/\x0A/\x0D/;
chomp $line;
print $line;
}
close($sock);
print "\n";
__END__
For domain names, the place to start with is whois.crsnic.net. For IP
addresses, start with whois.arin.net. crisnic.net will return which
registrar's whois server to look up the domain with. ARIN returns the owner
for that IP range or a reference to the correct counterpart overseas.
CRSNIC produces fairly consistant output, however the output of ARIN varies
depending on where the IP address is allocated. My problem is one of
parsing the output, much of which is extraneous.
Sample CRSNIC output:
Whois Server Version 1.3
Domain names in the .com, .net, and .org domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
Domain Name: CAVEMANOG.ORG
Registrar: TUCOWS, INC.
Whois Server: whois.opensrs.net
Referral URL: http://www.opensrs.org
Name Server: SJC.NAMESERVER.NET
Name Server: SOU.NAMESERVER.NET
Updated Date: 01-jun-2001
>>> Last update of whois database: Sat, 29 Sep 2001 05:50:16 EDT <<<
The Registry database contains ONLY .COM, .NET, .ORG, .EDU domains and
Registrars.
Sample ARIN output (IP range in North America):
Concentric Network Corporation (NET-CNCX-BLK-1) CNCX-BLK-1
205.158.0.0 - 205.158.255.255
PC Skill Center (NETBLK-INEXVAR-PCSKILLCENTER) INEXVAR-PCSKILLCENTER
205.158.160.0 - 205.158.175.255
To single out one record, look it up with "!xxx", where xxx is the
handle, shown in parenthesis following the name, which comes first.
The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and whois.nic.mil for NIPRNET Information.
Sample ARIN output (IP range in Europe):
European Regional Internet Registry/RIPE NCC (NET-RIPE-NCC-)
These addresses have been further assigned to European users.
Contact info can be found in the RIPE database, via the
WHOIS and TELNET servers at whois.ripe.net, and at
http://www.ripe.net/db/whois.html
NL
Netname: RIPE-NCC-212
Netblock: 212.0.0.0 - 212.255.255.255
Maintainer: RIPE
Coordinator:
Reseaux IP European Network Co-ordination Centre Singel 258
(RIPE-NCC-ARIN) [EMAIL PROTECTED]
+31 20 535 4444
Domain System inverse mapping provided by:
NS.RIPE.NET 193.0.0.193
NS.EU.NET 192.16.202.11
AUTH03.NS.UU.NET 198.6.1.83
NS2.NIC.FR 192.93.0.4
SUNIC.SUNET.SE 192.36.125.2
MUNNARI.OZ.AU 128.250.1.21
NS.APNIC.NET 203.37.255.97
To search on arbitrary strings, see the Database page on
the RIPE NCC web-site at http://www.ripe.net/db/
Record last updated on 16-Oct-1998.
Database last updated on 28-Sep-2001 23:24:38 EDT.
The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and whois.nic.mil for NIPRNET Information.
One last thing: The source code for the geektools whois proxy is available,
and might serve as inspiration. See: http://www.geektools.com/software.php
which also contains a list of whois servers.
