Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: WHOIS contacts are your friends - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
WHOIS contacts are your friends

You’ve rocked up to work ready to start the day and get on with the list of jobs the boss has graciously gifted you with, when your daily routing of reviewing the logs brings the normal sigh as x.x.x.x is externally scanning and probing for open ports on the perimeter.

Depending on the security stance or care factor the offending IP address may go in a block list, be ignored, be investigated further or none of the above. Let’s say that you want to report this so you do a quick WHOIS lookup on the offending IP address. There are plenty of web sites that offer WHOIS lookups but if you want to perform searches from the command line Swa Frantzen’s guide [1] is a great refresher.

This is where you can run in to a very frustrating road block of the Useless Contact Email Details. The two worst offenders are the fake email addresses (none@nowhere.com being a favourite) or the horribly out of date email address of that goes deep into cyber space never to be seen again. One of the fun parts about being on the defensive team is trying to work out if it’s worthwhile telling someone their computers aren’t playing nice any more. So make it easy for them to do that and if someone makes that effort, be a good internet citizen and have a valid, current email address on the WHOIS record.

NOTE – Before the screaming and tearing of hair occurs because I’m advocating putting a valid email address that can be use be the evil smurfs gain information on you or the company, feel free to use on of the numerous WHOIS protection services that shields your email behind one of their email addresses. As long as the email gets to you, that’s all that matters.

Fixing WHOIS record details is easy and straightforward*, so get it done and tick off that New Year’s resolution to help out the internet.

Oh, and should you get a call from someone notifying that something might be wrong with your systems, fellow handler Tom Liston came up with a fairly comprehensive list on how not to response to someone giving you the heads up [2].


[1] http://isc.sans.edu/diary.html?storyid=9325
[2] http://isc.sans.edu/diary.html?storyid=1260

* Unless you work for a big, very big company, so get raised a work ticket and have some poor soul work out how to do it and treat yourself to something nice.


Chris Mohan --- Internet Storm Center Handler on Duty

Chris

105 Posts
ISC Handler
My individual work e-mail address has been in whois for more than 20 years. The benefits *far* outweigh any negative experiences that I may or may not have had.
Ken

40 Posts
The referenced links at the bottom of the article are in the wrong order #1 links to Tom's diary and #2 links to Swa's diary.
PW

63 Posts
The main downside of listing on WHOIS is the junk messages received over postal mail. In the form of letters from the likes of the "Domain Registry of America" and others sending "Bills" to "renew my domain" at outrageous prices such as $30+/year for a .COM.

(Or rather, items that are cleverly designed to look exactly like bills, but contain fine print, that by responding, you are authorizing a domain transfer)
Mysid

146 Posts
The firewall keeps me from doing whois from the cmd line. I found that robtex.com is a pretty good resource for whois and a lot more when investigating an IP; a judicous application of NoScript and AdBlock makes the site more pleasant.

BTW, whatever happened to the contact handles that you could do a whois lookup on? I used to be listed under a 5-character handle consisting of my initials and a 3-digit number.
Hal

50 Posts
@Hal ARIN still has the handles (with the addition of -ARIN on the end). I suspect that the explosion of domain registrars has made the use of handles on that side of the coin difficult to impossible.
Ken

40 Posts

Sign Up for Free or Log In to start participating in the conversation!