How to Run a Whois Lookup with PHP or Python

How do I run a WHOIS lookup with PHP or Python?

This should do exactly what you want... http://www.phpwhois.org/

I've used this class before, doing exactly what you want!

Is there a way to emulate the 'whois' tool using php?

You can use the PHP Whois API. This will allow you access to all the whois records. To use that function there is a link at the bottom of that page to a class. Make sure you include that too.

How to get WhoIs info by IP in Python 3?

Install the stable release of dnspython from here

Then pip3 install ipwhois.

In [37]: from ipwhois import IPWhois

In [38]: obj = IPWhois('74.125.225.229')

In [39]: res=obj.lookup()

In [40]: res["nets"][0]['country']
Out[40]: 'US'

In [41]: res["nets"][0]['abuse_emails']
Out[41]: 'arin-contact@google.com'

In [42]: from pprint import pprint

In [43]: pprint(res)
{'asn': '15169',
'asn_cidr': '74.125.225.0/24',
'asn_country_code': 'US',
'asn_date': '2007-03-13',
'asn_registry': 'arin',
'nets': [{'abuse_emails': 'arin-contact@google.com',
'address': '1600 Amphitheatre Parkway',
'cidr': '74.125.0.0/16',
'city': 'Mountain View',
'country': 'US',
'created': '2007-03-13T00:00:00',
'description': 'Google Inc.',
'misc_emails': None,
'name': 'GOOGLE',
'postal_code': '94043',
'state': 'CA',
'tech_emails': 'arin-contact@google.com',
'updated': '2012-02-24T00:00:00'}],
'query': '74.125.225.229',
'raw': None}

HTTP:

In [44]: res=obj.lookup_rws()

In [45]: pprint(res)
{'asn': '15169',
'asn_cidr': '74.125.225.0/24',
'asn_country_code': 'US',
'asn_date': '2007-03-13',
'asn_registry': 'arin',
'nets': [{'abuse_emails': 'arin-contact@google.com',
'address': '1600 Amphitheatre Parkway',
'cidr': '74.125.0.0/16',
'city': 'Mountain View',
'country': 'US',
'created': '2007-03-13T12:09:54-04:00',
'description': 'Google Inc.',
'misc_emails': None,
'name': 'GOOGLE',
'postal_code': '94043',
'state': 'CA',
'tech_emails': 'arin-contact@google.com',
'updated': '2012-02-24T09:44:34-05:00'}],
'query': '74.125.225.229',
'raw': None}

The API has changed, for the legacy ipwhois IPWhois.lookup() is deprecated as of v0.12.0 and will be removed. Legacy whois lookups were moved to IPWhois.lookup_whois()..

You can access that method, I have disabled warnings to be able to see the output, there are deprecated warnings that should be taken into account in real use cases:

In [30]: from warnings import filterwarnings

In [31]: filterwarnings( action="ignore")

In [32]: from ipwhois import IPWhois

In [33]: obj = IPWhois('74.125.225.229')

In [34]: obj.lookup_whois()
Out[34]:
{'asn': '15169',
'asn_cidr': '74.125.225.0/24',
'asn_country_code': 'US',
'asn_date': '2007-03-13',
'asn_description': 'GOOGLE - Google Inc., US',
'asn_registry': 'arin',
'nets': [{'address': '1600 Amphitheatre Parkway',
'cidr': '74.125.0.0/16',
'city': 'Mountain View',
'country': 'US',
'created': '2007-03-13',
'description': 'Google Inc.',
'emails': ['arin-contact@google.com', 'network-abuse@google.com'],
'handle': 'NET-74-125-0-0-1',
'name': 'GOOGLE',
'postal_code': '94043',
'range': '74.125.0.0 - 74.125.255.255',
'state': 'CA',
'updated': '2012-02-24'}],
'nir': None,
'query': '74.125.225.229',
'raw': None,
'raw_referral': None,
'referral': None}

The docs state, IPWhois.lookup_rdap() is now the recommended lookup method. RDAP provides a far better data structure than legacy whois and REST lookups (previous implementation). RDAP queries allow for parsing of contact information and details for users, organizations, and groups. RDAP also provides more detailed network information.

But following the usage example verbatim, or adding the asn_methods=["whois"]), stills gives deprecation warnings so, again, that is something that needs to be addressed in actual use cases.

In [31]: from ipwhois import IPWhois

In [32]: obj = IPWhois('74.125.225.229')
/usr/local/lib/python3.6/site-packages/ipwhois/net.py:138: UserWarning: allow_permutations has been deprecated and will be removed. It is no longer needed, due to the deprecation of asn_alts, and the addition of the asn_methods argument.
warn('allow_permutations has been deprecated and will be removed. '

In [33]: obj.lookup_rdap(asn_methods=["whois"])
/usr/local/lib/python3.6/site-packages/ipwhois/asn.py:302: UserWarning: IPASN._parse_fields_whois() has been deprecated and will be removed. You should now use IPASN.parse_fields_whois().
warn('IPASN._parse_fields_whois() has been deprecated and will be '
Out[33]:
{'asn': '15169',
'asn_cidr': '74.125.225.0/24',
'asn_country_code': 'US',
'asn_date': '2007-03-13',
'asn_description': 'GOOGLE - Google Inc., US',
'asn_registry': 'arin',
'entities': ['GOGL'],
'network': {'cidr': '74.125.0.0/16',
'country': None,
'end_address': '74.125.255.255',
'events': [{'action': 'last changed',
'actor': None,
'timestamp': '2012-02-24T09:44:34-05:00'},
{'action': 'registration',
'actor': None,
'timestamp': '2007-03-13T12:09:54-04:00'}],
'handle': 'NET-74-125-0-0-1',
'ip_version': 'v4',
'links': ['https://rdap.arin.net/registry/ip/074.125.000.000',
'https://whois.arin.net/rest/net/NET-74-125-0-0-1'],
'name': 'GOOGLE',
'notices': [{'description': 'By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use',
'links': ['https://www.arin.net/whois_tou.html'],
'title': 'Terms of Service'}],
'parent_handle': 'NET-74-0-0-0-0',
'raw': None,
'remarks': None,
'start_address': '74.125.0.0',
'status': None,
'type': None},
'nir': None,
'objects': {'GOGL': {'contact': {'address': [{'type': None,
'value': '1600 Amphitheatre Parkway\nMountain View\nCA\n94043\nUNITED STATES'}],
'email': None,
'kind': 'org',
'name': 'Google Inc.',
'phone': None,
'role': None,
'title': None},
'entities': ['ABUSE5250-ARIN', 'ZG39-ARIN'],
'events': [{'action': 'last changed',
'actor': None,
'timestamp': '2017-01-28T08:32:29-05:00'},
{'action': 'registration',
'actor': None,
'timestamp': '2000-03-30T00:00:00-05:00'}],
'events_actor': None,
'handle': 'GOGL',
'links': ['https://rdap.arin.net/registry/entity/GOGL',
'https://whois.arin.net/rest/org/GOGL'],
'notices': None,
'raw': None,
'remarks': None,
'roles': ['registrant'],
'status': None}},
'query': '74.125.225.229',
'raw': None}

PHP Script That Finds The Registrar of Any Domain Name

A very simple WHOIS client I just threw together based on this specification and this list of servers.

It seems to work reasonably well, however the important thing to note here is that the WHOIS protocol, such as it is defined (and it's the worst definition of a protocol I've ever seen) is clearly designed to be return human-readable documents, and no effort is made to make it computer-readable. This is a sorry state of affairs that has irritated me a great deal in the past.

As a result, the below, very simple code, already contains an edge-case workaround for .com domains, and uses an incredibly generic regex that will likely give false positives and false negatives.

class WHOISClient
{
private $servers = array(
'ac' => 'whois.nic.ac',
'ae' => 'whois.aeda.net.ae',
'aero' => 'whois.aero',
'af' => 'whois.nic.af',
'ag' => 'whois.nic.ag',
'al' => 'whois.ripe.net',
'am' => 'whois.amnic.net',
'as' => 'whois.nic.as',
'asia' => 'whois.nic.asia',
'at' => 'whois.nic.at',
'au' => 'whois.aunic.net',
'ax' => 'whois.ax',
'az' => 'whois.ripe.net',
'ba' => 'whois.ripe.net',
'be' => 'whois.dns.be',
'bg' => 'whois.register.bg',
'bi' => 'whois.nic.bi',
'biz' => 'whois.neulevel.biz',
'bj' => 'www.nic.bj',
'br' => 'whois.nic.br',
'br.com' => 'whois.centralnic.com',
'bt' => 'whois.netnames.net',
'by' => 'whois.ripe.net',
'bz' => 'whois.belizenic.bz',
'ca' => 'whois.cira.ca',
'cat' => 'whois.cat',
'cc' => 'whois.nic.cc',
'cd' => 'whois.nic.cd',
'ch' => 'whois.nic.ch',
'ck' => 'whois.nic.ck',
'cl' => 'nic.cl',
'cn' => 'whois.cnnic.net.cn',
'cn.com' => 'whois.centralnic.com',
'co' => 'whois.nic.co',
'co.nl' => 'whois.co.nl',
'com' => 'whois.verisign-grs.com',
'coop' => 'whois.nic.coop',
'cx' => 'whois.nic.cx',
'cy' => 'whois.ripe.net',
'cz' => 'whois.nic.cz',
'de' => 'whois.denic.de',
'dk' => 'whois.dk-hostmaster.dk',
'dm' => 'whois.nic.cx',
'dz' => 'whois.nic.dz',
'edu' => 'whois.educause.net',
'ee' => 'whois.tld.ee',
'eg' => 'whois.ripe.net',
'es' => 'whois.ripe.net',
'eu' => 'whois.eu',
'eu.com' => 'whois.centralnic.com',
'fi' => 'whois.ficora.fi',
'fo' => 'whois.nic.fo',
'fr' => 'whois.nic.fr',
'gb' => 'whois.ripe.net',
'gb.com' => 'whois.centralnic.com',
'gb.net' => 'whois.centralnic.com',
'qc.com' => 'whois.centralnic.com',
'ge' => 'whois.ripe.net',
'gl' => 'whois.nic.gl',
'gm' => 'whois.ripe.net',
'gov' => 'whois.nic.gov',
'gr' => 'whois.ripe.net',
'gs' => 'whois.nic.gs',
'hk' => 'whois.hknic.net.hk',
'hm' => 'whois.registry.hm',
'hn' => 'whois2.afilias-grs.net',
'hr' => 'whois.ripe.net',
'hu' => 'whois.nic.hu',
'hu.com' => 'whois.centralnic.com',
'ie' => 'whois.domainregistry.ie',
'il' => 'whois.isoc.org.il',
'in' => 'whois.inregistry.net',
'info' => 'whois.afilias.info',
'int' => 'whois.isi.edu',
'io' => 'whois.nic.io',
'iq' => 'vrx.net',
'ir' => 'whois.nic.ir',
'is' => 'whois.isnic.is',
'it' => 'whois.nic.it',
'je' => 'whois.je',
'jobs' => 'jobswhois.verisign-grs.com',
'jp' => 'whois.jprs.jp',
'ke' => 'whois.kenic.or.ke',
'kg' => 'whois.domain.kg',
'kr' => 'whois.nic.or.kr',
'la' => 'whois2.afilias-grs.net',
'li' => 'whois.nic.li',
'lt' => 'whois.domreg.lt',
'lu' => 'whois.restena.lu',
'lv' => 'whois.nic.lv',
'ly' => 'whois.lydomains.com',
'ma' => 'whois.iam.net.ma',
'mc' => 'whois.ripe.net',
'md' => 'whois.nic.md',
'me' => 'whois.nic.me',
'mil' => 'whois.nic.mil',
'mk' => 'whois.ripe.net',
'mobi' => 'whois.dotmobiregistry.net',
'ms' => 'whois.nic.ms',
'mt' => 'whois.ripe.net',
'mu' => 'whois.nic.mu',
'mx' => 'whois.nic.mx',
'my' => 'whois.mynic.net.my',
'name' => 'whois.nic.name',
'net' => 'whois.verisign-grs.com',
'nf' => 'whois.nic.cx',
'ng' => 'whois.nic.net.ng',
'nl' => 'whois.domain-registry.nl',
'no' => 'whois.norid.no',
'no.com' => 'whois.centralnic.com',
'nu' => 'whois.nic.nu',
'nz' => 'whois.srs.net.nz',
'org' => 'whois.pir.org',
'pl' => 'whois.dns.pl',
'pr' => 'whois.nic.pr',
'pro' => 'whois.registrypro.pro',
'pt' => 'whois.dns.pt',
'pw' => 'whois.nic.pw',
'ro' => 'whois.rotld.ro',
'ru' => 'whois.tcinet.ru',
'sa' => 'saudinic.net.sa',
'sa.com' => 'whois.centralnic.com',
'sb' => 'whois.nic.net.sb',
'sc' => 'whois2.afilias-grs.net',
'se' => 'whois.nic-se.se',
'se.com' => 'whois.centralnic.com',
'se.net' => 'whois.centralnic.com',
'sg' => 'whois.nic.net.sg',
'sh' => 'whois.nic.sh',
'si' => 'whois.arnes.si',
'sk' => 'whois.sk-nic.sk',
'sm' => 'whois.nic.sm',
'st' => 'whois.nic.st',
'so' => 'whois.nic.so',
'su' => 'whois.tcinet.ru',
'tc' => 'whois.adamsnames.tc',
'tel' => 'whois.nic.tel',
'tf' => 'whois.nic.tf',
'th' => 'whois.thnic.net',
'tj' => 'whois.nic.tj',
'tk' => 'whois.nic.tk',
'tl' => 'whois.domains.tl',
'tm' => 'whois.nic.tm',
'tn' => 'whois.ripe.net',
'to' => 'whois.tonic.to',
'tp' => 'whois.domains.tl',
'tr' => 'whois.nic.tr',
'travel' => 'whois.nic.travel',
'tw' => 'whois.twnic.net.tw',
'tv' => 'whois.nic.tv',
'tz' => 'whois.tznic.or.tz',
'ua' => 'whois.ua',
'uk' => 'whois.nic.uk',
'uk.com' => 'whois.centralnic.com',
'uk.net' => 'whois.centralnic.com',
'gov.uk' => 'whois.ja.net',
'us' => 'whois.nic.us',
'us.com' => 'whois.centralnic.com',
'uy' => 'nic.uy',
'uy.com' => 'whois.centralnic.com',
'uz' => 'whois.cctld.uz',
'va' => 'whois.ripe.net',
'vc' => 'whois2.afilias-grs.net',
've' => 'whois.nic.ve',
'vg' => 'whois.adamsnames.tc',
'ws' => 'whois.website.ws',
'xxx' => 'whois.nic.xxx',
'yu' => 'whois.ripe.net',
'za.com' => 'whois.centralnic.com'
);

private function locateServer($domain)
{
$parts = explode('.', $domain);

for ($i = 0, $l = count($parts); $i < $l; $i++) {
$root = implode('.', $parts);

if (isset($this->servers[$root])) {
return $this->servers[$root];
}

array_shift($parts);
}

throw new \UnexpectedValueException('Unknown TLD in domain ' . $domain);
}

private function makeRequest($server, $domain)
{
$sock = stream_socket_client("tcp://$server:43", $errNo, $errStr, 3);
if (!$sock) {
throw new \RuntimeException('Unable to connect to WHOIS server at ' . $server . ':43');
}

if ($server == $this->servers['com']) {
// .com domains are a special case, there may be others as well
$domain = "=$domain";
}

if (!fwrite($sock, "$domain\r\n")) {
throw new \RuntimeException('Error sending request to server at ' . $server . ':43');
}

return stream_get_contents($sock);
}

private function findRegistrar($raw)
{
if (preg_match('/registrar\s*[:\-=][^a-z0-9]*([^\r\n]+)/i', $raw, $matches)) {
return trim($matches[1]);
}

return false;
}

public function queryRegistrar($domain)
{
$server = $this->locateServer($domain);

$raw = $this->makeRequest($server, $domain);

return $this->findRegistrar($raw);
}
}

Use it like:

$client = new WHOISClient;
var_dump($client->queryRegistrar('google.com'));

PHP domain whois script not return all information

I found a possible solution, assuming (as checked by myself) registrar whois servers are returning contact infos.

To do this, it is needed for each domain to query related registrar whois server as per code below.

Check code comments for little explanation of what each function does.

function GetWhoisInfo($whoisserver, $domain){
$port = 43;
$timeout = 10;
$fp = @fsockopen($whoisserver, $port, $errno, $errstr, $timeout) or die("Socket Error " . $errno . " - " . $errstr);
stream_set_blocking($fp, true);
fputs($fp, $domain . "\r\n");
$out = "";

while(!feof($fp)){
$out .= fgets($fp);
}

fclose($fp);
return $out;
}

function GetRegistrarWhoisServer($whoisserver, $domain) {
$out = GetWhoisInfo($whoisserver, $domain);
$rws_string = explode("\r\n", $out);
$rws = explode("Registrar WHOIS Server: ", $rws_string[2])[1];
return $rws;
}

function WhoisToJson($winfo) {
$winfoarr = explode(PHP_EOL, $winfo);
$jsonarr = [];
foreach($winfoarr as $info){
$infodata = explode(": ", $info);
if($infodata[0] !== "")$jsonarr[$infodata[0]] = $infodata[1];
//avoid to process privacy info at the end of whois service output
if($infodata[0] === "DNSSEC")break;
}
return json_encode($jsonarr);
}

function QueryWhoisServer($whoisserver, $domain) {
//query to $whoisserver whois to get registrar whois server address only
$rws = GetRegistrarWhoisServer($whoisserver, $domain);

//query to registrar whois server (registrar whois servers are returning contact infos)
$out = GetWhoisInfo($rws, $domain);

//parsing infos and formatting to json
return WhoisToJson($out);
}

echo QueryWhoisServer("whois.verisign-grs.com", "google.com");

Get whois output in CodeIgniter

I Got Best way to call WHOIS domain lockup services

<?php
$username="username";
$password="password";
$contents = file_get_contents("http://www.whoisxmlapi.com//whoisserver/WhoisService?domainName=google.com&username=$username&password=$password&outputFormat=JSON");
//echo $contents;
$res=json_decode($contents);
if($res){
if($res->ErrorMessage){
echo $res->ErrorMessage->msg;
}
else{
$whoisRecord = $res->WhoisRecord;
if($whoisRecord){
echo "Domain name: " . print_r($whoisRecord->domainName,1) ."<br/>";
echo "Created date: " .print_r($whoisRecord->createdDate,1) ."<br/>";
echo "Updated date: " .print_r($whoisRecord->updatedDate,1) ."<br/>";
if($whoisRecord->registrant)echo "Registrant: <br/><pre>" . print_r($whoisRecord->registrant->rawText, 1) ."</pre>";
//print_r($whoisRecord);
}
}
}

?>

Fast way to see if a domain is in use or registered using PHP

You could try parse "http://whois.domaintools.com/" . $domain

and look for the keyword "Domain Available"



Related Topics



Leave a reply



Submit