abuse-whois

abuse_whois

A Sigma and RDAP/Whois based abuse contacts finder.

This tool is highly inspired from the following libraries:

• https://github.com/bradleyjkemp/abwhose
• https://github.com/certsocietegenerale/abuse_finder

How It Works

• Query a given address via RDAP (fallback to Whois is if RDAP fails)
• Check a query result with Sigma rules and find contacts (fallback to regex if there is no match)

Requirements

• Python 3.10+

Installation

pip install abuse_whois

# or if you want to use built-in REST API
pip install abuse_whois[api]

Usage

As a library

from abuse_whois import get_abuse_contacts

await get_abuse_contacts("1.1.1.1")
await get_abuse_contacts("github.com")
await get_abuse_contacts("https://github.com")
await get_abuse_contacts("foo@example.com")

As a CLI tool

abuse_whois 1.1.1.1
abuse_whois example.com
abuse_whois foo@example.com
abuse_whois http://example.com

As a REST API

$ uvicorn abuse_whois.api.main:app
INFO:     Started server process [2283]
INFO:     Waiting for application startup.
INFO:     Application startup complete.
INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)

$ http localhost:8000/api/whois/ address=https://github.com

With Docker

git clone https://github.com/ninoseki/abuse_whois
cd abuse_whois
docker build . -t abuse-whois
docker run -i -d -p 8000:8000 abuse-whois

Settings

All settings can be done via environment variables or .env file.

Contributions

abuse_whois works based on a combination of static rules and a parsing result of whois response.

• Rules:
  • Registrar and hosting provider
  • Shared hosting provider

Please submit a PR (or submit a feature request) if you find something missing.