9

Using the command line tools available in a common GNU/Linux distro (e.g. Fedora/Debian/Ubuntu/etc), is there a general way to get the value of some specific WHOIS field (e.g. the registrant's organisation name), ideally without having to build a custom WHOIS parser that is hard-coded to handle the differences between each registry's output?

This seems worth asking, because the output from the whois command does not appear to be very consistent. For example, compare:

$ whois trigger.io [...] Owner OrgName : Amir Nathoo [...]

with:

$ whois facebook.com [...] Registrant Organization: Facebook, Inc. [...]

I would like, instead, to be able to pass, as arguments to some command:

  • the domain name
  • the desired field

and have the output simply be the value of the desired field. For instance, based on the examples above, something like:

$ some_whois_command -field organization_name trigger.io Amir Nathoo $ some_whois_command -field organization_name facebook.com Facebook, Inc.

Is this possible?

Ideally, I would like the solution to centre on the whois command, e.g. with some suitable usage of -i, -q, -t, and/or -v, as I want to learn how to make effective use of these options. I will accept another solution as correct if necessary, however.

Improve this question

3 Answers 3

Reset to default
5

The problem appears to be at least two-fold:

  • WHOIS responses do not share a common schema, and
  • there is a dearth of WHOIS clients able to parse WHOIS responses and to map their fields (e.g. using a suitable ontology) onto a single schema. The Ruby Whois project is the most extensive effort I have found. It aims to provide a parser for each of the 500+ different WHOIS servers, and its developers deserve immense credit, but it remains a work in progress.

This is a sorry state of affairs.

The IETF's proposed solution for this and other WHOIS woes is called the Registration Data Access Protocol (RDAP).

Quoting RFC 7485, which explains the rationale for RDAP:

In the domain name space, there were over 200 country code
Top-Level Domains (ccTLDs) and over 400 generic Top-Level Domains
(gTLDs) when this document was published. Different Domain Name
Registries may have different WHOIS response objects and formats. A
common understanding of all these data formats was critical to
construct a single data model for each object.

(Emphasis mine.)

Unfortunately, whereas most (all?) TLD registries provide WHOIS servers for their subdomains, only one two TLD registries have so far formally fielded RDAP servers for their subdomains: CZNIC for .cz domains, and NIC Argentina for .ar domains. So, this is not (yet) a generally applicable solution across a wide range of TLDs. We can only hope that all the other registries will hurry up and field RDAP servers.

As for software, the only RDAP command line client for POSIX systems that I have found so far is nicinfo.

Improve this answer
4

You may use python

 pip install whois

For instance, 

#!/bin/python import whois print whois.whois('www.facebook.com')['city']
Improve this answer
2
  • @sampablokuper many distros package things you can get from pypi, E.g. packages.debian.org/search?keywords=python-whois Commented Feb 4, 2017 at 15:22
  • 1
    domain = whois.query('trigger.io') results in Exception: Unknown TLD: io, so this answer doesn't provide a general solution at all. Even for recognised TLDs, the library fails to parse the organisation name: import whois; from pprint import pprint; domain = whois.query('pcguide.com'); pprint (vars(domain)) gives just 6 fields (creation_date, expiration_date, last_updated, name, name_servers, and registrar), even though many more exist. Commented Feb 6, 2017 at 13:58
-1

What fields are you interested in from what TLDs? Doign a quick check against .com .net and .org the actual data fields have the same name... easy enough to whois foo.org | grep "Registrant Organization:" or whatever field you care about.

If you need a script, something like

#!/bin/bash if [ $# -ne 2 ] then echo Usage: $0 fieldcode domain exit fi case $1 in "ro") whois $2 | grep "Registrant Organization:" ;; "te") whois $2 | grep "Tech Email:" ;; esac # or use simple if-thens if [ $1 == "r" ] then whois $2 | grep "Registrant " fi

Which gives output like

$ ./whoisg r myfqdn.org Registrant ID: go2016965629 Registrant Name: Contact Privacy Inc. Customer 1241082755 Registrant Organization: Contact Privacy Inc. Customer 1241082755 Registrant Street: 96 Mowat Ave Registrant City: Toronto Registrant State/Province: ON Registrant Postal Code: M4K 3K1 Registrant Country: CA Registrant Phone: +1.4165385487 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: [email protected]

or 

$ ./whoisg te myfqdn.org Tech Email: [email protected]

HTH

Improve this answer
1
  • Thanks, but this would manifestly fail on the first example in my question. Commented Feb 4, 2017 at 20:14

You must log in to answer this question.