Ravi Sir's Cyber Security Cards › Revision Cards
whois and dig
whois and dig whois shows who owns a domain or IP: registrar, dates, name servers. dig asks DNS for a name’s records. whois example.com → registrar and expiry. dig example.com MX → mail servers. These are passive recon tools: info gathering without touching the target’s own servers. Attackers use th
Read card text
What this card says
What it is
whois shows who owns a domain or IP: registrar, dates, name servers.
dig asks DNS for a name’s records.
Example
whois example.com → registrar and expiry.
dig example.com MX → mail servers.
Why it matters for security
These are passive recon tools: info gathering without touching the target’s own servers.
Attackers use them to map a target. Defenders use them to see what is public.
| Record | What recon learns |
|---|---|
| A / AAAA | IP addresses of hosts |
| MX | Mail servers (phishing and mail attacks target these) |
| NS | Authoritative servers to query (and try AXFR on) |
| TXT | SPF/DMARC policy, cloud verification tokens |
| CNAME | Aliases – dangling ones enable subdomain takeover |
Learn more in the lesson: 19.2 whois and dig