untangling_the_web

DOClD: 4046925
UNCLASSIFIEDIf..Oft O.... leIAL tJs!: er~LY
How to Research a Dornaln Name or IP
Address
In a previous section, I discussed the differences between domain name and whois
lookups. Now I am going to walk through some basic research steps to learn how to
analyze who registered a domain name and/or who owns an IP address. There are a
number of ways to research domain names and IP addresses and many tools on the
Internet that can help provide information about a domain or IP address.
Important Caveat: despite what you may hear or read elsewhere, you cannot
ascertain the location or ownership of a domain name or IP address based solely on
the fact it is in one of the most commonly used top-level domains, i.e., .com, .org, or
.net. Names in these domains may be registered by anyone anywhere in the world.
Likewise, domains registered in specific country top-level domains, e.g., .ru, .pk, .fr,
are only presumed to be registered by non-US entities, but there is no guarantee
based on the top-level domain alone this is the case. The point is simple: all domain
names must be researched, with a few exceptions. The exceptions are .mil, .gov,
and .edu, all of which are, at least theoretically, restricted to US-entities. There are
even some exceptions in these cases. However, you may safely assume domain
names or IP addresses associated with a .mil, .gov, or .edu top-level domain are US
entities.
Steps for researching a domain name and IP address:
1. Does the domain name or IP address correspond to an Internet website?
If so, the first step is to use a good search tool such as Google to find out more
about the site. The info: command at Google will show you links to Google's cache
of the page, pages that are similar to the webpage, pages that link to this site, and
pages that contain the search term. For this article, I will use a high-profile Russian
anti-virus company Kaspersky Labs because it has registered domain names in both
the .com and .ru top-level domains.
474 UNCLASSIFIED"FOR OJ;FICIAL I:JSE ONLY