Who is Asking and for What: WHOIS Traffic Analysis

Abstract

The paper presents analysis of WHOIS requests for 13-month period. Both requestor address and the domain name being requested are analyzed, showing that WHOIS traffic can be roughly classified into systematic scanning of domain names and individual low-volume activity, mostly targeting very popular names. The comparison of requested names with standard dictionary entries reveals typical mutations for registered names, and mutations performed by scanning automata. As most popular names in WHOIS coincide with standard top website ranks, the ways of utilizing WHOIS data for the benefit of Internet community as a whole, are proposed.