WHOIS – Nameserver View Details
The Investigate WHOIS Nameserver view displays the WHOIS information for a nameserver. A nameserver is a domain. A domain identifies as an authoritative nameserver when it provides responses to requests about names in a zone. However, any domain registrant can assign any domain as a nameserver, even if the domain is not serving records for their domain.
The WHOIS information for a domain enables you to find additional domains related to a certain domain. For instance, if you search for a domain that is flagged as malicious, you can locate other domains that are registered with the same nameserver.
To get started, enter the domain name of a nameserver in the Investigate Smart Search, or pivot to the Nameserver view from the Domain view. If you begin your search from a Domain view, follow the links to the nameserver information from the WHOIS data.
Table of Contents
Prerequisites
- A minimum of Investigate Only access to the Umbrella dashboard. See Manage the Investigate Only User Role.
Research WHOIS Nameserver From Domain View
The information described in the WHOIS record is retrieved from the Investigate WHOIS database and reflects an association between a domain that is a nameserver and another domain which is served by the nameserver.
Click on the link to the nameserver, or the number of the Associated Domains to view the domains associated with the nameserver.
Note: Umbrella Investigate lists no more than 500 domains associated with a nameserver.
It is possible for a nameserver to have an A Record for its own domain. By recording its domain name, a nameserver can show its domain along with its stored domain records.
In the Domain and IP Address views, Investigate provides detailed information about the domain or IP address. The nameserver information in the Domain or IP address views are gathered from DNS data from our DNS resolvers and is an association between IP address and domain.
WHOIS Nameserver View
The WHOIS Nameserver view displays a list of the malicious domains, security categories, content categories, and indicator of when the domain was last observed. Investigate categorizes when a domain was last observed as: Current or Past. Investigate displays Current if the domain currently belongs to the name server and Past if the domain once belonged to this nameserver.
Click the link to the domain name to display the Domain view for the domain.
WHOIS – Email View Details < WHOIS – Nameserver View Details > ASN View Details
Updated almost 2 years ago