1 particular IP checking Whois repeatedly. What does it mean ?

[koolkr]

Would like some ideas
Why would someone repeatedly check on the whois of my domain ?
Something like 12 times in the past 2 months

Thanks

 

[D Haynes]

Wow, really? must’ve missed it from all the up-sells.

You sure, it’s free? Every-time i go to GD website
“cover your wallet!”

Samer

GD is incredibly expensive for most things its true.

 

[Paul]

If it's a recent registration or has recently had its nameserver changed, the queries are most likely automated. Feel free to DM me the IP if you want me to check.

 

[ResoluteDomains]

Its probably Amazon AWS or "Facebook Ireland Ltd" which seems to ping my domains dozens of times daily for reasons beyond my understanding.

 

[manpreet]

Would like some ideas
Why would someone repeatedly check on the whois of my domain ?
Something like 12 times in the past 2 months

Thanks

Did you list it at some marketplaces, maybe they are trying to verify the Whois details, etc.

 

[Paul]

Its probably Amazon AWS or "Facebook Ireland Ltd" which seems to ping my domains dozens of times daily for reasons beyond my understanding.

If you're seeing AWS, it's probably companies like SecurityTrails, DomainTools, RiskIQ, etc. It could also mean someone used a WHOIS website that's hosted on AWS.

Generally, if someone looks up your domain's WHOIS info using a generic, registrar-agnostic website instead of with a proper WHOIS client, it's probably going to show the website's IP address, not the actual user's.

 

[equity78]

If you're seeing AWS, it's probably companies like SecurityTrails, DomainTools, RiskIQ, etc. It could also mean someone used a WHOIS website that's hosted on AWS.

Generally, if someone looks up your domain's WHOIS info using a generic, registrar-agnostic website instead of with a proper WHOIS client, it's probably going to show the website's IP address, not the actual user's.

That's what I thought have a few names where this keeps happening but there has never been an offer, so must just be bots and the like.

 

[Paul]

That's what I thought have a few names where this keeps happening but there has never been an offer, so must just be bots and the like.

Even when they are initiated by real people, most people who query WHOIS don't do so directly; they use random websites, so the IP addresses you'd see are for random web servers.

WHOIS is valuable data for security purposes, though, so most of it is probably automated. Oftentimes these scans are triggered when a nameserver change occurs. It's interesting to know how many queries you're getting, but it's hard to actually determine what the data represents.

 

[equity78]

Even when they are initiated by real people, most people who query WHOIS don't do so directly; they use random websites, so the IP addresses you'd see are for random web servers.

WHOIS is valuable data for security purposes, though, so most of it is probably automated. Oftentimes these scans are triggered when a nameserver change occurs. It's interesting to know how many queries you're getting, but it's hard to actually determine what the data represents.

Thanks Paul, yeah I have a couple names not super valuable and they have 300 queries and a few valuable names only have like 30.

 

[Jurgen Wolf]

https://www.namepros.com/threads/bodis.484866/page-223#post-7552986