threat_recon_whois.py

Automatically compares whois record components against Threat Recon’s whois database and then writes to a CSV. This is useful for seeing if there are any correlations from an unknown domain or IP to any known bad record logged by Threat Recon.

Requires:
-Sysinternal’s Whois (http://technet.microsoft.com/en-us/sysinternals/bb897435.aspx) for domain searches and Nirsoft's WhosIP (http://www.nirsoft.net/utils/whosip.html) for network whois. 
-Netaddr module
-whois_extractor.py