Network Security Hacks

Find the Owner of a Network

Track down network contacts using WHOIS databases.

Looking through your IDS logs, you’ve seen some strange traffic coming from another network across the Internet. When you look up the IP address in DNS, it resolves as something like dhcp-103.badguydomain.com. Who do you contact to help track down the person who sent this traffic? You’re probably already aware that you can use the whois command to find out contact information for owners of Internet domain names. If you haven’t used whois, it’s as simple as typing, well, “whois”:

$ whois badguydomain.com
Registrant:
   Dewey Cheatum

   Registered through: GoDaddy.com
   Domain Name: BADGUYDOMAIN.COM

   Domain servers in listed order:
      PARK13.SECURESERVER.NET
      PARK14.SECURESERVER.NET
   For complete domain details go to:
   http://whois.godaddy.com

Unfortunately, this whois entry isn’t as helpful as it might be. Normally, administrative and technical contacts are listed, complete with a phone number and email and snail mail addresses. Evidently, http://godaddy.com has a policy of releasing this information only through their web interface, apparently to cut down on spam harvesters. But if the registrant’s name is listed as “Dewey Cheatum,” how accurate do you think the rest of this domain record is likely to be? Although domain registrants are “required” to give legitimate information when setting up a domain, I can tell you from experience that using whois in this way is a great tool for tracking down honest people.

Since ...