Whois

Overview

Utility plugin provides the ability to retrieve whois information for a domain and navigate flows based on domain ages.

Functionality

Provides utility nodes for retrieving whois information for a domain and navigate flows based on domain ages.

The whois nodes do not currently support all TLDs.

Flow Node

Utility Node for retrieving whois information for a domain.

Property

Description

Name

The display name of the node within the flows.

Domain

This field defines the location from the message, flow, global, or JavaScript expression to use as the data source for the whois query. Additionally, the node context can also be changed. The following contexts are supported.

msg.: This selects part of the incoming message as the source of the data. This is typical choice.
flow.: This selects part of the flow context’s saved data as the source. This information is shared with only the nodes on a given tab.
global.: This selects part of the global context’s saved data as the source. This information is shared by all nodes regardless of tab.
J: expression: JSONata expression language to perform query and transform operations on the payload.

Utility Node for retrieving domain age from whois information for a domain.

Property

Description

Name

The display name of the node within the flows.

Age Threshold

This field defines the number of days a domain must exist before being considered safe.

Learn More

JSON Message Format

The following samples show the JSON content added to the message payload, which conform to Node Messaging Format. The content exists within the whois object.

Success

The italicized, green text is inserted into the message payload upon a successful request. The NL-Whois node in the following sample was configured to use the msg.payload.ioc.domain as the domain name to query.

"payload": {
    "whois": {
        "domainName":"nevelexlabs.com",
        "registryDomainId":"2200254086_DOMAIN_COM-VRSN",
        "registrarWhoisServer":"whois.google.com",
        "registrarUrl":"https://domains.google.com",
        "updatedDate":"2018-12-16T03:45:49Z",
        "creationDate":"2017-12-15T19:04:01Z",
        "registrarRegistrationExpirationDate":"2019-12-15T19:04:01Z",
        "registrar":"Google LLC",
        "registrarIanaId":"895",
        "registrarAbuseContactEmail":"registrar-abuse@google.com",
        "registrarAbuseContactPhone":"+1.8772376466",
        "domainStatus":"ok https://www.icann.org/epp#ok",
        "registrantName":"Contact Privacy Inc. Customer 1242035599",
        "registrantOrganization":"Contact Privacy Inc. Customer 1242035599",
        "registrantStreet":"96 Mowat Ave",
        "registrantCity":"Toronto",
        "registrantStateProvince":"ON",
        "registrantPostalCode":"M4K 3K1",
        "registrantCountry":"CA",
        "registrantPhone":"+1.4165385487",
        "registrantEmail":"wd5h20t1fcpy@contactprivacy.email",
        ... admin* section ...
        ... tech* section ...
        "nameServer":"NS-CLOUD-A1.GOOGLEDOMAINS.COM NS-CLOUD-A2.GOOGLEDOMAINS.COM NS-CLOUD-A3.GOOGLEDOMAINS.COM NS-CLOUD-A4.GOOGLEDOMAINS.COM",
        "dnssec":"unsigned",
        "urlOfTheIcannWhoisDataProblemReportingSystem":"http://wdprs.internic.net/",
        "lastUpdateOfWhoisDatabase":"2019-01-18T20:06:01Z <<<",
        "pleaseRegisterYourDomainsAt":"https://domains.google.com/"
    },
    "ioc": {
        "domain": "nevelexlabs.com"
    }
}

Error

The italicized, maroon text is inserted into the message payload upon a failed request. The NL-Whois node in the following sample was configured to use the msg.payload.ioc.domain as the domain name to query.

"payload": {
    "whois": {
        "error": {
            "error_code": 6,
            "error_message": "Error fetching whois information for this_is_not_a_domain.com"
        }
    },
    "ioc": {
        "domain": "this_is_not_a_domain.com"
    }
}

Nevelex Labs, Main Office

Metro Office Park
2950 Metro Drive, Suite 104
Bloomington, MN 55425
Phone: +1 952-500-8921

Contact Us

EULA