UNIT-5

Researching and mapping source domains and IP addresses using WHOIS is a common practice for
gathering information about domain ownership, registration details, and network infrastructure. WHOIS is a
protocol used to query databases that store information about registered domain names and IP addresses.
Below is a step-by-step guide on how to use WHOIS to research domains and IPs:

1. Understanding WHOIS
 WHOIS Databases: These databases contain details about domain registrations, such as the
registrar, registrant (owner), creation and expiration dates, name servers, and contact information.
 IP WHOIS: For IP addresses, WHOIS provides information about the organization or entity that
owns the IP range, the regional internet registry (RIR), and network details.

2. Tools for WHOIS Lookup

 Online WHOIS Tools: Websites like WHOIS Lookup, ICANN Lookup, or ARIN WHOIS provide
easy access to WHOIS data.
 Command-Line Tools: On Linux or macOS, you can use the whois command in the terminal
(e.g., whois example.com).
 APIs: Services like WHOISXMLAPI or DomainTools offer APIs for programmatic access to
WHOIS data.

3. Steps to Research a Domain

1. Perform a WHOIS Lookup:

o Enter the domain name (e.g., example.com) into a WHOIS lookup tool.

o Review the output for details like:

 Registrant: Name, organization, and contact information of the domain owner.

 Registrar: The company that registered the domain.

 Creation/Expiration Dates: When the domain was registered and when it will
expire.

 Name Servers: The servers used to resolve the domain to an IP address.

2. Analyze the Results:

o Look for patterns or connections to other domains (e.g., shared registrant email or name
servers).

o Check for red flags, such as privacy protection services (e.g., WHOISGuard) that may
obscure the owner's identity.

3. Map Related Domains:

o Use the registrant's email or name to search for other domains they may own.
o Tools like DomainBigData or WhoisXML can help identify associated domains.

1|Page
4. Steps to Research an IP Address

1. Perform an IP WHOIS Lookup:

o Enter the IP address (e.g., 192.0.2.1) into a WHOIS lookup tool.

o Review the output for details like:

 NetRange: The range of IP addresses owned by the organization.

 Organization: The entity that owns the IP range.

 Country: The geographic location of the IP address.

 ASN (Autonomous System Number): The network identifier for the IP.

2. Analyze the Results:

o Identify the organization or ISP associated with the IP.

o Check for abuse contact information if investigating malicious activity.

3. Map the IP to Other Domains:

o Use reverse IP lookup tools (e.g., YouGetSignal or ViewDNS) to find other domains hosted
on the same IP.
5. Advanced Techniques

 Historical WHOIS Data: Use services like WhoisHistory to view past WHOIS records and track
changes in ownership.

 Bulk WHOIS Lookups: For large-scale research, use tools like WHOISXMLAPI or DomainTools
to query multiple domains or IPs at once.
 Network Mapping: Combine WHOIS data with tools like nslookup, traceroute, or Shodan to map
network infrastructure.

DNS Hostname Resolution

DNS (Domain Name System) hostname resolution is the process of translating human-readable domain
names (e.g., www.example.com) into machine-readable IP addresses (e.g., 192.0.2.1). This process is
essential for enabling communication over the internet, as devices rely on IP addresses to locate and
connect to each other. Below is a detailed explanation of how DNS hostname resolution works:

1. DNS Basics

 Domain Name: A human-readable address (e.g., www.example.com).

 IP Address: A numerical label assigned to devices on a network (e.g., 192.0.2.1 for IPv4
or 2001:0db8::1 for IPv6).

 DNS Servers: Specialized servers that store DNS records and respond to queries.

2. Steps in DNS Hostname Resolution

When you enter a domain name in your browser, the following steps occur to resolve the domain to an IP
address:
2|Page
 Step 1: Local Cache Check

 The system first checks its local DNS cache to see if it already has the IP address for the domain.

 If the IP is found in the cache, the resolution process ends here.

Step 2: Query the Recursive Resolver

 If the IP is not in the local cache, the system sends a query to a recursive DNS resolver (usually
provided by your ISP or a public DNS service like Google DNS or Cloudflare).

 The recursive resolver acts as an intermediary between your device and the DNS hierarchy.

Step 3: Query the Root Nameservers

 If the recursive resolver does not have the IP address cached, it queries one of the root nameservers.

 The root nameservers do not know the IP address but can direct the resolver to the appropriate Top-
Level Domain (TLD) nameservers (e.g., .com, .org).

Step 4: Query the TLD Nameservers

 The recursive resolver queries the TLD nameserver for the domain's extension (e.g., .com).

 The TLD nameserver responds with the authoritative nameserver for the specific domain
(e.g., example.com).

Step 5: Query the Authoritative Nameserver

 The recursive resolver queries the authoritative nameserver for the domain
(e.g., ns1.example.com).

 The authoritative nameserver holds the DNS records for the domain and responds with the IP
address.

Step 6: Return the IP Address

 The recursive resolver receives the IP address and caches it for future use.

 The resolver then sends the IP address back to your device.

Step 7: Establish Connection

 Your device uses the IP address to establish a connection to the server hosting the website or service.

3. DNS Record Types

DNS resolution involves querying different types of DNS records. Some common record types include:

 A Record: Maps a domain to an IPv4 address.

 AAAA Record: Maps a domain to an IPv6 address.

 CNAME Record: Maps a domain to another domain (canonical name).

 MX Record: Specifies mail servers for email delivery.

 NS Record: Identifies the authoritative nameservers for the domain.

3|Page
  TXT Record: Stores text-based information, often used for verification or SPF records.

4. Tools for DNS Resolution

 Command-Line Tools:

o nslookup: Queries DNS servers for domain information.

o dig: A more advanced tool for querying DNS records.

o host: A simple tool for DNS lookups.

 Online Tools:

o DNS Checker

o MXToolbox

 Browser Developer Tools: Many browsers include DNS resolution details in their network
inspection tools.

5. Example: Using dig for DNS Resolution

To resolve a domain using the dig command:

bash
Copy

dig www.example.com

Output:

Copy

; <<>> DiG 9.16.1-Ubuntu <<>> www.example.com

;; global options: +cmd

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12345

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:

;www.example.com. IN A

;; ANSWER SECTION:

www.example.com. 300 IN A 192.0.2.1

;; Query time: 20 msec

4|Page
 ;; SERVER: 8.8.8.8#53(8.8.8.8)

;; WHEN: Fri Oct 13 12:00:00 UTC 2023

;; MSG SIZE rcvd: 59

 The ANSWER SECTION shows the resolved IP address (192.0.2.1).

6. Troubleshooting DNS Issues

 Check Local Cache: Clear the DNS cache on your device (e.g., ipconfig /flushdns on Windows).

 Verify DNS Settings: Ensure your device is using the correct DNS servers.

 Check for Typos: Ensure the domain name is spelled correctly.

 Test with Different Tools: Use multiple tools to confirm the issue is not tool-specific.

7. Importance of DNS

 User Experience: Makes it easier for users to access websites using memorable domain names.

 Load Balancing: DNS can distribute traffic across multiple servers.

 Redundancy: Multiple DNS servers ensure reliability and uptime.

 Security: DNS plays a role in preventing phishing and other attacks (e.g., DNSSEC).

Querying Passive DNS

Querying Passive DNS (Passive Domain Name System) is a technique used to gather historical DNS data,
which can be invaluable for cybersecurity investigations, threat intelligence, and network forensics. Unlike
traditional DNS queries, which provide real-time results, Passive DNS collects and stores DNS resolution
data over time, allowing analysts to track changes in domain ownership, IP associations, and malicious
activity. Below is a detailed guide on querying Passive DNS:

1. What is Passive DNS?

 Definition: Passive DNS is a database that records DNS query responses over time, creating a
historical record of domain-to-IP mappings.

 Purpose: It helps analysts identify patterns, track malicious domains, and investigate historical DNS
activity.

 Data Sources: Passive DNS data is collected from various sources, including recursive DNS servers,
sensors, and network traffic logs.

2. Key Use Cases for Passive DNS

 Threat Intelligence: Identify domains and IPs associated with malware, phishing, or other malicious
activities.

 Incident Response: Investigate historical DNS activity during a security incident.

 Domain Monitoring: Track changes in domain ownership, IP associations, or name servers.

 Network Forensics: Analyze DNS traffic to detect anomalies or unauthorized changes.

5|Page
3. How Passive DNS Works

 Data Collection: Passive DNS systems collect DNS responses from recursive resolvers or network
sensors.

 Data Storage: The collected data is stored in a database, often indexed by domain, IP, or timestamp.

 Query Interface: Users can query the database to retrieve historical DNS records.

4. Tools and Services for Querying Passive DNS

Several tools and services provide access to Passive DNS data:

Online Passive DNS Services

 VirusTotal: Offers Passive DNS data for domains and IPs as part of its threat intelligence reports.

 SecurityTrails: Provides historical DNS data, including A, AAAA, MX, and NS records.

 RiskIQ PassiveTotal: A comprehensive tool for querying Passive DNS and other threat intelligence
data.

 CIRCL Passive DNS: A free Passive DNS database maintained by CIRCL (Computer Incident
Response Center Luxembourg).

Command-Line Tools

 dnstwist: A domain permutation tool that can query Passive DNS to find typosquatting domains.

 passivedns-client: A command-line client for querying Passive DNS databases.

APIs
 SecurityTrails API: Provides programmatic access to Passive DNS data.

 VirusTotal API: Includes Passive DNS data in its domain and IP reports.

5. Steps to Query Passive DNS

1. Choose a Tool or Service:

o Select a Passive DNS tool or service based on your needs (e.g., free vs. paid, API vs. web
interface).

2. Enter the Domain or IP:

o Input the domain name (e.g., example.com) or IP address (e.g., 192.0.2.1) into the query
interface.

3. Review the Results:

o Analyze the historical DNS records, including:

 A/AAAA Records: IP addresses associated with the domain.

 Name Servers: DNS servers used by the domain.

6|Page
  Timestamps: When the records were observed.

 Associated Domains: Other domains sharing the same IP or name servers.

4. Identify Patterns or Anomalies:

o Look for suspicious changes, such as sudden shifts in IP addresses or associations with
known malicious domains.

6. Example: Querying Passive DNS with SecurityTrails

1. Go to https://securitytrails.com.

2. Enter the domain name (e.g., example.com) in the search bar.

3. Navigate to the "DNS History" section.

4. Review the historical A, AAAA, MX, and NS records.

7. Example: Querying Passive DNS with VirusTotal

1. Go to https://www.virustotal.com.

2. Enter the domain name or IP address in the search bar.

3. Navigate to the "Relations" tab.

4. Review the Passive DNS data under the "Historical DNS Records" section.

8. Advanced Techniques

 Bulk Queries: Use APIs to query multiple domains or IPs at once.

 Correlation Analysis: Combine Passive DNS data with other threat intelligence sources (e.g.,
WHOIS, SSL certificates) to identify connections.

 Timeline Analysis: Track changes in DNS records over time to detect suspicious activity.

9. Limitations of Passive DNS

 Incomplete Data: Passive DNS databases may not have records for all domains or IPs.

 Privacy Concerns: Some domains may use privacy protection services, obscuring their true
ownership.

 Data Freshness: Passive DNS data may not be updated in real time.

Checking DNS Records:

Checking DNS (Domain Name System) records is a fundamental task for managing domains,
troubleshooting connectivity issues, and ensuring proper configuration of online services. DNS records map
domain names to IP addresses and provide essential information for email delivery, website hosting, and
other network services. Below is a comprehensive guide on how to check DNS records:

1. What Are DNS Records?

DNS records are entries in a DNS database that provide information about a domain, such as:

 A Record: Maps a domain to an IPv4 address.

7|Page
  AAAA Record: Maps a domain to an IPv6 address.

 CNAME Record: Maps a domain to another domain (canonical name).

 MX Record: Specifies mail servers for email delivery.

 NS Record: Identifies the authoritative nameservers for the domain.

 TXT Record: Stores text-based information, often used for verification (e.g., SPF, DKIM).

 SOA Record: Contains administrative information about the domain (e.g., primary nameserver,
contact email).

 PTR Record: Maps an IP address to a domain (used for reverse DNS lookups).

2. Tools for Checking DNS Records

There are several tools and methods to check DNS records:

Online Tools

 DNS Checker: https://dnschecker.org

 MXToolbox: https://mxtoolbox.com
 ViewDNS.info: https://viewdns.info

 Google Admin Toolbox: https://toolbox.googleapps.com

Command-Line Tools

 dig: A powerful DNS lookup tool available on Linux and macOS.

 nslookup: A simple tool for querying DNS records.

 host: A command-line utility for DNS lookups.

Browser Developer Tools

 Many browsers include DNS resolution details in their network inspection tools.

3. Steps to Check DNS Records

Using Online Tools

1. Visit a DNS lookup tool (e.g., DNS Checker).

2. Enter the domain name (e.g., example.com).

3. Select the type of DNS record you want to check (e.g., A, MX, TXT).

4. Review the results, which will display the relevant DNS records.

Using dig (Command Line)

1. Open a terminal or command prompt.

2. Use the dig command followed by the domain name and record type:

8|Page
bash

Copy

dig example.com A

o Replace A with the desired record type (e.g., MX, TXT, NS).

3. Review the output, which includes the queried DNS records.

Using nslookup (Command Line)

1. Open a terminal or command prompt.

2. Use the nslookup command followed by the domain name:

bash

Copy

nslookup -type=A example.com

o Replace A with the desired record type (e.g., MX, TXT, NS).
3. Review the output, which includes the queried DNS records.

4. Common DNS Record Types and Examples

A Record

 Maps a domain to an IPv4 address.

 Example:

bash

Copy
dig example.com A

Output:

Copy

example.com. 300 IN A 192.0.2.1

AAAA Record

 Maps a domain to an IPv6 address.

 Example:
bash

Copy

dig example.com AAAA

Output:

Copy
9|Page
example.com. 300 IN AAAA 2001:0db8::1

CNAME Record

 Maps a domain to another domain (canonical name).

 Example:

bash

Copy

dig www.example.com CNAME

Output:

Copy

www.example.com. 300 IN CNAME example.com.

MX Record

 Specifies mail servers for email delivery.

 Example:

bash

Copy

dig example.com MX

Output:

Copy

example.com. 300 IN MX 10 mail.example.com.

TXT Record

 Stores text-based information (e.g., SPF, DKIM).

 Example:

bash

Copy

dig example.com TXT

Output:
Copy

example.com. 300 IN TXT "v=spf1 include:_spf.example.com ~all"

NS Record

 Identifies the authoritative nameservers for the domain.

 Example:
10 | P a g e
bash

Copy

dig example.com NS

Output:

Copy

example.com. 300 IN NS ns1.example.com.

example.com. 300 IN NS ns2.example.com.

SOA Record

 Contains administrative information about the domain.

 Example:

bash

Copy
dig example.com SOA

Output:

Copy

example.com. 300 IN SOA ns1.example.com. admin.example.com. 2023101301 7200 3600

1209600 3600

PTR Record

 Maps an IP address to a domain (used for reverse DNS lookups).

 Example:

bash
Copy

dig -x 192.0.2.1

Output:

Copy

1.2.0.192.in-addr.arpa. 300 IN PTR example.com.

5. Troubleshooting DNS Issues

 Check for Typos: Ensure the domain name is spelled correctly.

 Verify DNS Settings: Confirm that the domain is using the correct nameservers.
 Clear DNS Cache: Flush the DNS cache on your device (e.g., ipconfig /flushdns on Windows).

 Test with Multiple Tools: Use different tools to confirm the issue is not tool-specific.

11 | P a g e
Creating Static Maps

Creating static maps involves generating a fixed, non-interactive visual representation of geographic data.
Static maps are commonly used in reports, presentations, and websites where interactivity is not required.
Below is a step-by-step guide to creating static maps using various tools and programming libraries:

1. Tools for Creating Static Maps

There are several tools and libraries available for creating static maps, depending on your needs and
technical expertise:

Online Tools

 Google Static Maps API: Generates static maps using Google Maps data.

 Mapbox Static Maps API: Provides high-quality static maps with customizable styles.

 OpenStreetMap Static Maps: Uses OpenStreetMap data to create static maps.

Programming Libraries
 Python:

o folium: A library for creating interactive maps, which can be saved as static images.

o matplotlib + basemap: For creating custom static maps.

o plotly: Can generate static maps using its plotly.express module.

 R:

o ggplot2 + ggmap: For creating static maps in R.

o leaflet: Can export interactive maps as static images.

 JavaScript:

o Leaflet.js: Can be used with plugins to export maps as static images.

2. Steps to Create Static Maps

Using Google Static Maps API

1. Get an API Key:

o Sign up for a Google Cloud account and enable the Static Maps API.

o Obtain an API key from the Google Cloud Console.

2. Construct the URL:

o Use the following format to create a static map URL:

Copy

https://maps.googleapis.com/maps/api/staticmap?center=<latitude>,<longitude>&zoom=<zoom_level>&siz
e=<width>x<height>&maptype=<map_type>&key=<API_KEY>

Example:

12 | P a g e
Copy

https://maps.googleapis.com/maps/api/staticmap?center=40.7128,-
74.0060&zoom=12&size=600x400&maptype=roadmap&key=YOUR_API_KEY

3. Display or Save the Map:

o Open the URL in a browser to view the map.

o Use a tool like wget or curl to download the map as an image.

Using Mapbox Static Maps API

1. Get an Access Token:

o Sign up for a Mapbox account and obtain an access token.

2. Construct the URL:

o Use the following format to create a static map URL:

Copy

https://api.mapbox.com/styles/v1/mapbox/<style_id>/static/<longitude>,<latitude>,<zoom_level>/<width>x
<height>?access_token=<ACCESS_TOKEN>

Example:

Copy
https://api.mapbox.com/styles/v1/mapbox/streets-v11/static/-
74.0060,40.7128,12/600x400?access_token=YOUR_ACCESS_TOKEN

3. Display or Save the Map:

o Open the URL in a browser to view the map.

o Download the map as an image using a tool like wget or curl.

Using Python (folium)

1. Install folium:

bash

Copy

pip install folium

2. Create and Save a Map:

python

Copy

import folium

# Create a map centered at a specific location

13 | P a g e
map = folium.Map(location=[40.7128, -74.0060], zoom_start=12)

# Save the map as an HTML file

map.save("map.html")

# Optionally, use a tool like `imgkit` to convert the HTML to an image

# pip install imgkit

import imgkit

imgkit.from_file('map.html', 'map.png')

Using Python (matplotlib + basemap)

1. Install matplotlib and basemap:

bash
Copy

pip install matplotlib basemap

2. Create and Save a Map:

python

Copy

from mpl_toolkits.basemap import Basemap

import matplotlib.pyplot as plt

# Create a map

map = Basemap(projection='merc', lat_0=40.7128, lon_0=-74.0060,

resolution='h', area_thresh=0.1,

llcrnrlon=-74.1, llcrnrlat=40.6,

urcrnrlon=-73.9, urcrnrlat=40.8)

# Draw coastlines, countries, and states

map.drawcoastlines()

map.drawcountries()

map.drawstates()

# Save the map as an image

14 | P a g e
plt.savefig('map.png')

Using R (ggplot2 + ggmap)

1. Install ggplot2 and ggmap:

Copy

install.packages("ggplot2")

install.packages("ggmap")

2. Create and Save a Map:

Copy

library(ggmap)

# Get a map centered at a specific location

map <- get_map(location = c(lon = -74.0060, lat = 40.7128), zoom = 12, maptype = "roadmap")

# Plot the map

ggmap(map)

# Save the map as an image

ggsave("map.png")

Creating Interactive Maps.

Creating interactive maps allows users to explore geographic data dynamically, offering features like
zooming, panning, and clicking on elements for more information. Interactive maps are widely used in web
applications, data visualization, and storytelling. Below is a comprehensive guide to creating interactive
maps using various tools and libraries:

1. Tools for Creating Interactive Maps

There are several tools and libraries available for creating interactive maps, depending on your needs and
technical expertise:

Web-Based Tools

 Google Maps JavaScript API: Embed interactive Google Maps in web applications.

 Mapbox GL JS: A powerful library for creating custom interactive maps.

 Leaflet.js: A lightweight, open-source library for interactive maps.

 ArcGIS Online: A platform for creating and sharing interactive maps.

Programming Libraries

 Python:

15 | P a g e
 o folium: A library for creating interactive maps using Leaflet.js.

o plotly: Supports interactive maps through its plotly.express module.

o bokeh: A library for creating interactive visualizations, including maps.

 R:

o leaflet: An R package for creating interactive maps using Leaflet.js.

o plotly: Supports interactive maps in R.

 JavaScript:

o Leaflet.js: A lightweight library for interactive maps.

o D3.js: A powerful library for creating custom, data-driven maps.

2. Steps to Create Interactive Maps

Using Leaflet.js (JavaScript)

1. Include Leaflet.js in Your Project:

o Add the following links to your HTML file:

html

Copy

<link rel="stylesheet" href="https://unpkg.com/leaflet/dist/leaflet.css" />

<script src="https://unpkg.com/leaflet/dist/leaflet.js"></script>

Run HTML

2. Create a Map Container:

o Add a div element to your HTML file:

html

Copy

<div id="map" style="width: 600px; height: 400px;"></div>

Run HTML

3. Initialize the Map:

o Use JavaScript to create the map:

javascript

Copy

var map = L.map('map').setView([40.7128, -74.0060], 12);

// Add a tile layer (e.g., OpenStreetMap)

16 | P a g e
L.tileLayer('https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', {

attribution: '© OpenStreetMap contributors'

}).addTo(map);

// Add a marker

L.marker([40.7128, -74.0060]).addTo(map)

.bindPopup('New York City').openPopup();

4. Add Interactivity:

o Use Leaflet's methods to add markers, popups, and other interactive elements.

Using Mapbox GL JS (JavaScript)

1. Get an Access Token:

o Sign up for a Mapbox account and obtain an access token.

2. Include Mapbox GL JS in Your Project:

o Add the following links to your HTML file:

html

Copy

<link href="https://api.mapbox.com/mapbox-gl-js/v2.10.0/mapbox-gl.css" rel="stylesheet">

<script src="https://api.mapbox.com/mapbox-gl-js/v2.10.0/mapbox-gl.js"></script>

Run HTML
3. Create a Map Container:

o Add a div element to your HTML file:

html

Copy

<div id="map" style="width: 600px; height: 400px;"></div>

Run HTML

4. Initialize the Map:

o Use JavaScript to create the map:

javascript

Copy

mapboxgl.accessToken = 'YOUR_ACCESS_TOKEN';

var map = new mapboxgl.Map({

17 | P a g e
 container: 'map',

style: 'mapbox://styles/mapbox/streets-v11',

center: [-74.0060, 40.7128],

zoom: 12

});

// Add a marker

new mapboxgl.Marker()

.setLngLat([-74.0060, 40.7128])

.setPopup(new mapboxgl.Popup().setHTML('New York City'))

.addTo(map);

Using folium (Python)

1. Install folium:
bash

Copy

pip install folium

2. Create an Interactive Map:

python

Copy

import folium
# Create a map centered at a specific location

map = folium.Map(location=[40.7128, -74.0060], zoom_start=12)

# Add a marker

folium.Marker([40.7128, -74.0060], popup='New York City').add_to(map)

# Save the map as an HTML file

map.save("map.html")

3. View the Map:

o Open the map.html file in a web browser to interact with the map.

Using plotly (Python)

1. Install plotly:

bash

Copy
18 | P a g e
pip install plotly

2. Create an Interactive Map:

python

Copy

import plotly.express as px

# Create a scatter map

fig = px.scatter_mapbox(

lat=[40.7128],

lon=[-74.0060],

zoom=12,

center={"lat": 40.7128, "lon": -74.0060},

mapbox_style="open-street-map"
)

# Show the map

fig.show()

Using leaflet (R)

1. Install leaflet:

Copy
install.packages("leaflet")

2. Create an Interactive Map:

Copy

library(leaflet)

# Create a map

map <- leaflet() %>%

addTiles() %>%

setView(lng = -74.0060, lat = 40.7128, zoom = 12) %>%

addMarkers(lng = -74.0060, lat = 40.7128, popup = "New York City")

# Display the map

map
19 | P a g e