IT Forensics · OSINT
Conducting a forensic WHOIS search – analysing domain owner information in a forensically verifiable manner
WHOIS databases contain registration information on domains; whilst the scope of this information has been increasingly restricted by data protection regulations, it can still provide important clues regarding the date of registration, the registrar and, in some cases, contact details.
We carry out structured research into WHOIS data as part of existing cases and document the results in a manner that is forensically verifiable.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
Our OSINT investigations are always carried out as a complementary component to existing IT forensic, legal or internal corporate enquiries. Every step of the investigation and every piece of digital evidence found is documented and, where technically possible, archived to ensure traceability even if the original online content is subsequently altered or deleted.
Our services
We investigate current and, where available, historical WHOIS data for a relevant domain and document this in a manner that is forensically verifiable.
Typical areas of application
How a WHOIS search works
We systematically retrieve available WHOIS data for the relevant domain, check historical records for previous registration details and document the results in a chronological order that can be easily traced.
Why is a WHOIS search relevant in a forensic context?
Even where the current registration details have been anonymised, WHOIS data may still contain useful historical information drawn from past records.
The date on which a domain was registered can also provide important clues as to when an incident took place, for example in the case of phishing domains.
Frequently Asked Questions
LanCologne – IT Forensics OSINT Cologne
Do you require a professional OSINT investigation into „conducting a forensic WHOIS search"? LanCologne can assist you with the transparent, documented analysis of publicly available digital sources to support your IT forensic, legal or internal corporate enquiries.
Related to this topic
- Forensic analysis of DNS history – Forensic investigation of historical DNS records
- Analysing SSL/TLS certificates using OSINT – utilising certificate data forensically for infrastructure reconnaissance
- Conducting subdomain enumeration for forensic purposes – Forensically identifying associated subdomains within a target infrastructure
- Identifying phishing domains using OSINT – Forensically uncovering and documenting fraudulent domains