A dear user came up with a question and I would like to share my answer with you as you might have the same question.
The question was, why is the IP Address (e.g. 1.2.3.4) not working in the Whois tool and why is this IP Address converted to 3.4. ?
Short Answer: The Whois Tool requires a base domain name and not an IP Address.
But why is 1.2.3.4 converted to 3.4 ?
TL;DR: When entering 1.2.3.4, the Tool assumes 1.2.3.4 is a domain name with 1.2. being a subdomain of domain 3 with TLD 4. For your convenience and because Whois queries require a base domain without subdomains, it strips the subdomain part (1.2.) from what has been entered.
So far so good.
But why can’t this Tool simply automatically resolve an entered IP Address and use the resolved domain for the query. The reason is, that an IP Address could host many domains and not just one.
So what is the best way to find out more about an IP Address ?
There are basically two options in my App:
1.) The (I) Inspect Tool
First, you can try the (i) Inspect Tool. This Tool is quite powerful and provides a lot of information about any IP Address available on the network such as Domain, Reverse Domain, Provider and DNS Records – if available. From here, you can tap on the […] button and perform a Whois for each discovered Domain.
2.) The Certificates Tool
I mentioned this option a few times before, but it is still often forgotten or underestimated. What this Tool does is, it looks for any certificate available on the given IP Address. If it finds a certificate, it decodes the content and displays the result. The result reveal domain names running on that IP Address.
Below is an example for IP Address 8.8.8.8.
First, the results of the (i) Inspect Tool:
Second, the results of the Certificates Tool:
So you can see, there is a lot information that can be revealed from a single IP Address using my App.
To all of you celebrating Christmas, have a Merry Christmas and all the best for 2018!
Stay safe and secure!
Best Regards,
Marcus