dianecode/whosedomain repository overview

⁠WhoseDomain

WhoseDomain is a Python command line tool to attribute domains and websites, i.e., to identify the entity that owns the domain or website.

Given a domain name, WhoseDomain first checks if a WHOIS query returns the domain owner. If the WHOIS record does not identify a valid owner (e.g., due to WHOIS privacy protection services) then it tries to identify websites hosted on the domain (or its subdomains) and analyzes their infrastructure and web content to identify the identity of the owner.

Since WhoseDomain has many dependencies, we offer a docker image that contains the tool with the configured dependencies.

⁠Import Docker Image from Docker Hub

docker pull dianecode/whosedomain:latest

⁠Tool Setup

⁠VirusTotal key

WhoseDomain uses the VirusTotal service to obtain subdomains of a domain. A key is needed to use the VirusTotal API. If you do not have a VirusTotal key, you can obtain a free key by registering an account⁠. The default free key is rate limited at 4 requests per minute, which should be enough for running the tool.

It is possible to run WhoseDomain without a VirusTotal key (instructions below), but the attribution results may be worse.

Once you have a VirusTotal key, you need to configure it by creating a config.ini file with the following content:

[virustotal]
vt_key = your_API_key

⁠Running WhoseDomain

To attribute a domain or a URL run:

docker run --rm --name whosedomain -v $(pwd)/config.ini:/app/attribution-master/framework/data/config.ini dianecode/whosedomain:latest -c data/config.ini -i <DOMAIN/URL>

If you do not have a VirusTotal key, you can run the tool without the config file:

docker run --rm --name whosedomain dianecode/whosedomain:latest -i <DOMAIN/URL>

For example, to attribute the domain amazon.com you would run:

docker run --rm --name whosedomain -v $(pwd)/config.ini:/app/attribution-master/framework/data/config.ini dianecode/whosedomain:latest -c data/config.ini -i amazon.com

This command returns:

Attributing fqdn	amazon.com
Owner:
  identity	Amazon Technologies, Inc.
Other Indicators:
  email	[email protected]
  esld	amazon.co.uk
  esld	amazon.com

The output first presents the identity of the Owner (Amazon Technologies, Inc.) followed by a list of other indicators that also belong to the owner, e.g., amazon.co.uk

To attribute a website simply provide a URL using the -i parameter:

docker run --rm --name whosedomain -v $(pwd)/config.ini:/app/attribution-master/framework/data/config.ini dianecode/whosedomain:latest -c data/config.ini -i https://www.google.com

This command returns:

Attributing url	https://www.google.com
Owner:
  identity	Google LLC
Other Indicators:
  aboutUrl	https://www.google.es/intl/es/about/products
  contactUrl	https://support.google.com/websearch/?p=ws_results_help&hl=es&fg=1
  contactUrl	https://support.google.com/websearch/answer/106230?hl=es
  esld	google.com
  privacyUrl	https://policies.google.com/privacy?hl=es&fg=1
  privacyUrl	https://policies.google.com/privacy?hl=es&fg=1&utm_source=ucbs
  privacyUrl	https://www.google.com/history/privacyadvisor/search/unauth?utm_source=googlemenu&fg=1&cctld=com
  tosUrl	https://policies.google.com/terms?hl=es&fg=1
  tosUrl	https://policies.google.com/terms?hl=es&fg=1&utm_source=ucbs

⁠Other options

⁠Changing the maximum number of iterations

WhoseDomain performs an iterative process that explores until (1) it finds an identity, (2) there is nothing else to explore, or (3) reaches a maximum number of iterations. By default WhoseDomain performs 50 iterations. If an identity is not found by the maximum number of iterations, the attribuiton fails even if there are still indicators to explore. You can increase the maximum number of iterations using the -n command line parameter. By increasing it, WhoseDomain may take longer to finish, but it has more chances to attribute the input domain.

docker run --rm --name whosedomain -v $(pwd)/config.ini:/app/attribution-master/framework/data/config.ini dianecode/whosedomain:latest -c data/config.ini -i amazon.com -n 100

⁠Checking the execution log

Sometimes WhoseDomain may output an unexpected (not necessarily wrong) identity. If you want to check how it arrived at that identity, you can check the log of the execution. For this, you first need to create an empty log file and then mount its volume:

touch whosedomain.log
docker run --rm --name whosedomain -v $(pwd)/config.ini:/app/attribution-master/framework/data/config.ini -v $(pwd)/whosedomain.log:/app/attribution-master/framework/whosedomain.log dianecode/whosedomain:latest -c data/config.ini -i amazon.com

⁠License

GNU Affero General Public License v3.0

⁠References

Reference to the paper after publication

⁠Contributors

Reference to the contributors after publication