Regarding advanced "whois" searches, question re-phrased...

[Eric Shubert]

On 09/04/2012 12:38 PM, Jim March wrote:
> OK, it turns out Mike Ballon's example won't work.
>
> Let me try to re-phrase the question:
>
> I have this rogue ISP/Webhost/Webdesign company - call 'em "badguycorp".
>   I don't want to say their name.  They are hosting websites that are
> legally and/or morally questionable.
>
> I want to find those websites.
>
> I have half a dozen or so known example domains that "badguycorp" is
> hosting/running.  Looking at their whois data, I know that the main
> point of commonality is the name servers.  All of them end in
> badguycorp.net <http://badguycorp.net> - with different
> stuff preceding those.  For example:
>
> ns3.tre.badguycorp.net <http://ns3.tre.badguycorp.net>
> ns2.fds.badguycorp.net <http://ns2.fds.badguycorp.net>
> ns1.jhg.badguycorp.net <http://ns1.jhg.badguycorp.net>
>
> So.  What I need to do is trawl for whois entries where the name
> server(s) end in "badguycorp.net <http://badguycorp.net>", and report
> what those websites are.
>
> Is there a way to do this, by any method, Linux command line or otherwise?
>
> Thanks!
>
> Jim
>
>

You *might try* to configure a DNS server to be a secondary/mirror of 
their DNS server(s), and replicate all the zone records from one of 
their servers using DNS zone transfer (AXFR). This is a standard method 
of replicating DNS records (which I'm not intimately familiar with). 
They might have their DNS secured to allow only certain IPs to transfer, 
but if they've been sloppy you might get lucky, especially with one of 
their secondary servers.

-- 
-Eric 'shubes'