Data Model WhoisObjectType Class The WhoisObjectType class is intended to characterize Whois information for a domain. The UML diagram corresponding to the WhoisObjectType class is shown in Figure 31. Figure . UML diagram of the WhoisObjectType class The property table of the WhoisObjectType class is given in Table 31. Table 3. Properties of the WhoisObjectType class Name Type Multiplicity Description Lookup_Date cyboxCommon: DateTimeObjectPropertyType 0..1 The Lookup_Date property specifies the date and time that the Whois record was queried. Domain_Name URIObj:URIObjectType 0..1 The Domain_Name property specifies the corresponding domain name for this Whois entry. Domain_ID cyboxCommon: StringObjectPropertyType 0..1 The Domain_ID property specifies the domain id for the domain associated with this Whois entry. Server_Name URIObj:URIObjectType 0..1 The Server_Name property specifies the corresponding server name for this Whois entry. This usually corresponds to a nameserver lookup.
IP_Address AddressObj: AddressObjectType 0..1 The IP_Address property specifies the corresponding ip address for this Whois entry. The usually corresponds to a nameserver lookup. DNSSEC WhoisDNSSECTypeEnum 0..1 The DNSSEC element corresponds to the DNSSEC property associated with a Whois entry. Acceptable values are: "Signed" or "Unsigned". Nameservers WhoisNameserversType 0..1 The Nameservers property represents a list of nameserver entries for a entry. Status WhoisStatusesType 0..1 The Status property represents a list of statuses for a given Whois entry. Updated_Date cyboxCommon: DateObjectPropertyType 0..1 The Updated_Date property specifies the date in which the registered domain information was last updated. Creation_Date cyboxCommon: DateObjectPropertyType 0..1 The Creation_Date property specifies the date in which the registered domain was created. Expiration_Date cyboxCommon: DateObjectPropertyType 0..1 The Expiration_Date property specifies the date in which the registered domain will expire. Regional_Internet_Registry cyboxCommon: RegionalRegistryType 0..1 The Regional_Internet_Registry property specifies the name of the Regional Internet Registry (RIR) which allocated the IP address contained in this Whois entry. Sponsoring_Registrar cyboxCommon: StringObjectPropertyType 0..1 The Sponsoring_Registrar property holds the name of the sponsoring registrar for the domain.
Registrar_Info WhoisRegistrarInfoType 0..1 The Registrar_Info property represents registrar info that would be returned from a registrar lookup. Registrants WhoisRegistrantsType 0..1 The Registrants property represents the registrant information associated with a domain lookup. Contact_Info WhoisContactType 0..1 The Contact_Info property represents contact info that would be returned from a contact lookup. Remarks cyboxCommon: StringObjectPropertyType 0..1 The Remarks property specifies any remarks associated with this Whois entry. WhoisRegistrarInfoType Class The property table of the WhoisRegistrarInfoType class is given in Table 32. Table . Properties of the WhoisRegistrarInfoType class Name Type Multiplicity Description Registrar_ID cyboxCommon: StringObjectPropertyType 0..1 The Registrar_ID corresponds to the Registrar ID property of a Whois entry. Registrar_GUID cyboxCommon: StringObjectPropertyType 0..1 The Registrar_GUID corresponds to the Registrar GUID property of a entry. Name cyboxCommon: StringObjectPropertyType 0..1 The Name property holds the name of the registrar organization.
Address cyboxCommon: StringObjectPropertyType 0..1 The Address property holds the address (location) of the registrar organization. Email_Address AddressObj: AddressObjectType 0..1 The Email_Address property holds the main email address for the registrar. Phone_Number cyboxCommon: StringObjectPropertyType 0..1 The Phone_Number property holds the phone number of the registrar organization. Whois_Server URIObj:URIObjectType 0..1 The Whois_Server property specifies the corresponding whois server for this registrar. Referral_URL URIObj:URIObjectType 0..1 The Referral_URL property specifies the corresponding referral URL for registrar. Contacts WhoisContactsType 0..1 The Contacts property specifies a list of registrar contacts. WhoisContactsType Class The WhoisContactsType class represents a list of contacts (usually registrar or registrant) found in a Whois entry. The property table of the WhoisContactsType class is given in Table 33. Table . Properties of the WhoisContactsType class Name Type Multiplicity Description Contact WhoisContactType 0..* The Contact property specifies a contact found in a Whois entry.
WhoisRegistrantInfoType Class The property table of the WhoisRegistrantInfoType class is given in Table 37. Table . Properties of the WhoisRegistrantInfoType class Name Type Multiplicity Description Registrant_ID cyboxCommon: StringObjectPropertyType 0..1 The Registrant_ID property specifies the registrant id for a registrant. WhoisRegistrantsType Class The WhoisRegistrantsType class represents a list of registrant information for a given Whois entry. The property table of the WhoisRegistrantsType class is given in Table 38. Table . Properties of the WhoisRegistrantsType class Name Type Multiplicity Description Registrant WhoisRegistrantInfoType 0..* The Registrant property Enumeration The literals of the WhoisStatusTypeEnum enumeration are in Table 39. . Literals of the WhoisStatusTypeEnum enumeration Enumeration Literal Description
Acknowledgments The following individuals have participated in the creation of this specification and are gratefully acknowledged: Aetna David Crawford AIT Austrian Institute of Technology Roman Fiedler Florian Skopik Australia and New Zealand Banking Group (ANZ Bank) Dean Thompson Blue Coat Systems, Inc. Owen Johnson Bret Jordan Century Link Cory Kennedy CIRCL Alexandre Dulaunoy Andras Iklody Raphaël Vinot Citrix Systems Joey Peloquin Dell Will Urbanski Jeff Williams DTCC Dan Brown Gordon Hundley Chris Koutras EMC Robert Griffin Jeff Odom Ravi Sharda Financial Services Information Sharing and Analysis Center (FS-ISAC) David Eilken Chris Ricard Fortinet Inc. Gavin Chow Airbus Group SAS Joerg Eschweiler Marcos Orallo Anomali Ryan Clough Wei Huang Hugh Njemanze Katie Pelusi Aaron Shelmire Jason Trost Bank of America Alexander Foley Center for Internet Security (CIS) Sarah Kelley Check Point Software Technologies Ron Davidson Cisco Systems Syam Appala Ted Bedwell David McGrew Pavan Reddy Omar Santos Jyoti Verma Cyber Threat Intelligence Network, Inc. (CTIN) Doug DePeppe Jane Ginn Ben Othman DHS Office of Cybersecurity and Communications (CS&C) Richard Struse Marlon Taylor EclecticIQ Marko Dragoljevic Joep Gommers Sergey Polzunov
Kenichi Terashita Fujitsu Limited Neil Edwards Frederick Hirsch Ryusuke Masuoka Daisuke Murabayashi Google Inc. Mark Risher Hitachi, Ltd. Kazuo Noguchi Akihito Sawada Masato Terada iboss, Inc. Paul Martini Individual Jerome Athias Peter Brown Jones Sanjiv Kalkar Bar Lockwood Terry MacDonald Alex Intel Corporation Tim Casey Kent Landfield JPMorgan Chase Bank, N.A. Terrence Driscoll David Laurance LookingGlass Allan Thomson Lee Vorthman Mitre Corporation Greg Back Jonathan Sean Barnum Desiree Beck Nicole Gong Jasen Jacobsen Ivan Kirillov Richard Piazza Jon Salwen Rutger Prins Andrei Sîrghi Raymon van der eSentire, Inc. Jacob Gajek FireEye, Inc. Phillip Boles Pavan Gorakav Anuj Kumar Shyamal Pandya Paul Patrick Scott Shreve Fox-IT Sarah Brown Georgetown University Eric Burger Hewlett Packard Enterprise (HPE) Sander IBM Allor Eldan Ben-Haim Sandra Hernandez Jason Keirstead John Morris Laura Rusu Ron Williams IID Chris Richardson Integrated Networking Technologies, Inc. Patrick Maroney Johns Hopkins University Applied Physics Laboratory Karin Marr Julie Modlin Mark Moss Pamela Smith Kaiser Permanente Russell Culpepper Beth Pumo Lumeta Corporation Brandon Hoffman MTG Management Consultants, LLC.
Charles Schmidt Emmanuelle Vargas-Gonzalez John Wunder National Council of ISACs (NCI) Scott Algeier Denise Anderson Josh Poster NEC Corporation Takahiro Kakumaru North American Energy Standards Board David Darnell Object Management Group Cory Casanave Palo Alto Networks Vishaal Hariprasad Queralt, Inc. John Tolbert Resilient Systems, Inc. Ted Julian Securonix Igor Baikalov Siemens AG Bernd Grobauer Soltra John Anderson Aishwarya Asok Kumar Peter Ayasse Jeff Beekman Michael Butt Cynthia Camacho Aharon Chernin Mark Clancy Brady Cotton Trey Darley Mark Davidson Paul Dion Daniel Dye Robert Hutto Raymond Keckler Ali Khan Chris Kiehl James Cabral National Security Agency Mike Boyle Jessica Fitzgerald-McKay New Context Services, Inc. John-Mark Gurney Christian Hunt James Moler Daniel Riedel Andrew Storms OASIS James Bryce Clark Robin Cover Chet Ensign Open Identity Exchange Don Thibeau PhishMe Inc. Josh Larkins Raytheon Company-SAS Daniel Wyschogrod Retail Cyber Intelligence Sharing Center Brian Engle Semper Fortis Solutions Joseph Brand Splunk Inc. Cedric LeRoux Brian Luger Kathy Wang TELUS Greg Reaume Alan Steer Threat Intelligence Pty Ltd Tyron Miller Andrew van der Stock ThreatConnect, Inc. Wade Baker Cole Iliff Andrew Pendergast Ben Schmoker Jason Spies TruSTAR Technology
Clayton Long Michael Pepin Natalie Suarez David Waters Benjamin Yates Symantec Corp. Curtis Kostrosky The Boeing Company Crystal Hayes ThreatQuotient, Inc. Ryan Trost U.S. Bank Mark Angel Brad Butts Fay Mona Magathan Yevgen Sautin US Department of Defense (DoD) James Bohling Eoghan Casey Gary Katz Jeffrey Mates VeriSign Robert Coderre Kyle Maxwell Eric Osterweil Chris Roblee United Kingdom Cabinet Office Iain Brown Adam Cooper Mike McLellan O’Brien James Penman Howard Staple Chris Taylor Laurie Thomson Alastair Treharne Julian White Bethany Yates US Department of Homeland Security Evette Maynard-Noel Justin Stekervetz ViaSat, Inc. Lee Chieffalo Wilson Figueroa Andrew May Yaana Technologies, LLC Anthony Rutkowski The authors would also like to thank the larger CybOX Community for its input and help in reviewing this document.