crits/crits_services — pull request #69 by wxsBSD (2014-11-25 18:37:17+00:00)
Title: WHOIS

Add a WHOIS service. The service supports three ways of getting WHOIS data.

1. A live lookup using pythonwhois. This works pretty well on common TLDs but fails on less common ones (.coop is a good example) due to the complete lack of standardization of WHOIS data. I figure pythonwhois is better than a hand-rolled parser so I went with that over our old one in core.

2. A pyDat lookup. This is configurable by just giving the URL to your pyDat install (eg: https://pyDat.example.org/).

3. A DomainTools lookup. This is configurable by providing your API key and username. The dtapi code was provided by Mark at DomainTools and is licensed under a permissive license. I made minor modifications so that it is a class and removed command-line support from it.

If the service is configured to do 2 or 3 it will disable the live option during run-time form generation. If neither 2 or 3 are configured it will prefer a live lookup.

The service also allows for adding indicators from returned email addresses.