I Did 52 WHOIS Lookups On Attackers — Here's What I Learned
security #api #webdev #discuss The chat went live at 2 PM. By 2:14 it was a war zone. I thought adding real-time chat to my dev blog would spark pair-programming threads. Instead, bots flooded it with phishing links and slurs. One bot even dropped an oddly specific threat about my home city. I flipped on request logging. In the next 24 hours it logged 52 distinct attacker hostnames. IP bans did nothing. They came back from new IPs, new ASNs, new registrars. IP bans felt like swatting flies. I wanted to know what these domains actually were. That's when I started bulk-WHOISing every domain they posted. What 52 hostile domains actually look like I wrote a small Python runner. Feed it a list of hostnames and it spits out JSON. The first version used public RDAP servers directly. Public RDAP servers were slow, rate-limited, and ccTLDs broke them. I wanted DNS, SSL, subdomains, email history, and takeover risk in the same response. I landed on the enrichment endpoint at RapidAPI and put the script on GitHub . import json , time , sys , os from urllib.parse import quote import requests RAPIDAPI_KEY = os . environ . get ( " RAPIDAPI_KEY " , "" ) BASE_URL = " https://domain-whois2.p.rapidapi.com/whois " HEADERS = { " X-RapidAPI-Key " : RAPIDAPI_KEY , " X-RapidAPI-Host " : " domain-whois2.p.rapidapi.com " } def lookup ( domain : str ): url = f " { BASE_URL } ?domain= { quote ( domain ) } " try : r = requests . get ( url , headers = HEADERS , timeout = 20 ) r . raise_for_status () return r . json () except requests . exceptions . Timeout : return { " domain " : domain , " error " : " timeout " } except requests . exceptions . HTTPError as e : return { " domain " : domain , " error " : f " http { e . response . status_code } " } except Exception as e : return { " domain " : domain , " error " : str ( e )} def batch ( domains , delay = 0.6 ): results = [] for d in domains : print ( f " [*] { d } " , file = sys . stderr ) results . append ( lookup ( d )) time . sleep ( delay ) r