whois-dns-recon

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

WHOIS & DNS Recon

WHOIS & DNS 信息侦察

Registration and DNS records reveal ownership, infrastructure, and mail security posture — all passive.

域名注册与DNS记录可被动揭示域名的所有权、基础设施及邮件安全态势。

WHOIS / RDAP

bash

whois example.com          # registrar, dates, nameservers, registrant

RDAP is the structured successor — query

https://rdap.org/domain/example.com

. Registrant details are often GDPR-redacted; the registrar, creation date, and nameservers still pivot well. Historical WHOIS (WhoisXML, SecurityTrails) can show pre-redaction owners and registrant email — feed those to

email-osint

bash

whois example.com          # 注册商、日期、域名服务器、注册者

RDAP是结构化的替代方案——可查询

https://rdap.org/domain/example.com

。注册者详情通常会因GDPR而被编辑；但注册商、创建日期及域名服务器仍能提供关键线索。历史WHOIS数据（如WhoisXML、SecurityTrails）可显示编辑前的所有者及注册者邮箱——可将这些信息导入

email-osint

工具。

DNS records

DNS记录

bash

dig example.com ANY +noall +answer
dig example.com MX +short           # mail servers
dig example.com TXT +short          # SPF, verification tokens
dig _dmarc.example.com TXT +short   # DMARC policy

A/AAAA → hosting IP; look up the ASN/host for shared-hosting neighbors.
MX → mail provider (Google/Microsoft/self-hosted).
TXT/SPF → third-party services the org uses (marketing, SaaS senders).
NS → DNS provider, and sometimes internal naming conventions.

bash

dig example.com ANY +noall +answer
dig example.com MX +short           # 邮件服务器
dig example.com TXT +short          # SPF、验证令牌
dig _dmarc.example.com TXT +short   # DMARC策略

A/AAAA → 托管IP；可查询对应的ASN/主机以了解共享托管的相邻对象。
MX → 邮件提供商（谷歌/微软/自托管）。
TXT/SPF → 组织使用的第三方服务（营销、SaaS发送方）。
NS → DNS提供商，有时还能体现内部命名规范。

Pivots

拓展分析方向

IP/ASN →
```
shodan-censys-recon
```
for exposed services.
Subdomains →
```
certificate-transparency
```
.
Registrant org/email →
```
company-osint
```
/
```
email-osint
```
.
Reused nameservers or MX across domains hint at the same owner.

IP/ASN → 使用
```
shodan-censys-recon
```
查找暴露的服务。
子域名 → 使用
```
certificate-transparency
```
工具。
注册者组织/邮箱 → 使用
```
company-osint
```
/
```
email-osint
```
工具。
多个域名共用相同域名服务器或MX记录，暗示它们属于同一所有者。