Information Gathering & OSINT

A tester runs a WHOIS query against a target's domain during reconnaissance. Which category of information is a WHOIS record most likely to provide?

• ARegistrar, registration and expiry dates, and the domain's authoritative name servers✓
• BThe full list of internal server hostnames sitting behind the corporate firewall along with the internal addressing used across the private corporate network
• CThe plaintext administrator password for the domain's hosting control panel
• DA live packet capture of all the traffic currently entering the network

Answer: WHOIS returns registration data such as the registrar, creation and expiry dates, and the delegated name servers, and sometimes registrant contact details unless privacy-protected. It does not expose internal hostnames, credentials, or live traffic.

A WHOIS lookup returns registrant fields populated with a proxy service's details instead of the organisation's own contacts. What does this indicate?

• AThe domain is still registered but its DNS records have been permanently deleted
• BThe registrar itself has been compromised and is now serving falsified records
• CA privacy or proxy registration is masking the real registrant's contact details✓
• DThe domain has fully expired and is no longer registered to an owner

Answer: Many registrars offer privacy or proxy registration, replacing the registrant's real details with the proxy's, so seeing a proxy is normal rather than a fault. It does not mean the domain has expired, that its DNS is gone, or that the registrar is compromised.