Who is asking and for what: WHOIS traffic analysis

Abstract

The paper presents analysis of WHOIS requests for 13-month period. Both requestor address and the domain name being requested are analyzed, showing that WHOIS traffic can be roughly classified into systematic scanning of do-main names and individual low-volume activity, mostly target-ing very popular names. The comparison of requested names with standard dictionary entries reveals typical mutations for registered names, and mutations performed by scanning au-tomata. As most popular names in WHOIS coincide with standard top website ranks, the ways of utilizingWHOIS data for the benefit of Internet community as a whole, are pro-posed.