--- title: WHOIS Parse slug: connectors/whois-parse docTags: createdAt: 2026-06-09T16:30:14.734Z --- ## Swimlane Parse WHOIS Connector WHOIS Parse provides automated extraction and structuring of registration and ownership details from WHOIS records for domains and IP addresses. WHOIS services provide essential information about domain and IP address registrations, including ownership, contact details, and availability status. The WHOIS Parse connector enables Swimlane Turbine users to automate the extraction and enrichment of registration data from domains, IP addresses, or raw WHOIS text. By integrating WHOIS data into security workflows, users can rapidly investigate suspicious domains or IPs, validate asset ownership, and enhance incident response with actionable context—without writing code. This streamlines threat analysis, supports compliance efforts, and accelerates decision-making in security operations. ## Prerequisites The WHOIS Connector does not require an asset. ## Capabilities The Swimlane Parse WHOIS bundle has the following capabilities: - Parse WHOIS text - WHOIS Lookup - WHOIS Lookup by IP # Actions ## Parse WHOIS Text Extract detailed registration information from provided WHOIS text for a specified domain. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------ | | `domain` | string | Required | Parameter for Parse WHOIS Text | | `text` | string | Required | Parameter for Parse WHOIS Text | ### Input Example `{"domain":"string","text":"string"}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | ------------------------------------- | | `headers` | array | HTTP headers for the request | | `headers.file_name` | string | HTTP headers for the request | | `headers.file` | string | HTTP headers for the request | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `address` | string | Output field: address | | `whois_server` | string | Output field: whois\_server | | `registrar` | string | Output field: registrar | | `raw_text` | string | Output field: raw\_text | | `city` | string | Output field: city | | `raw_json` | object | Output field: raw\_json | | `raw_json.domain_name` | object | Name of the resource | | `raw_json.registrar` | object | Output field: raw\_json.registrar | | `raw_json.whois_server` | object | Output field: raw\_json.whois\_server | | `raw_json.referral_url` | object | URL endpoint for the request | | `raw_json.updated_date` | object | Date value | | `raw_json.creation_date` | object | Date value | | `raw_json.expiration_date` | object | Date value | | `raw_json.name_servers` | object | Name of the resource | | `raw_json.status` | object | Status value | | `raw_json.emails` | object | Output field: raw\_json.emails | | `raw_json.dnssec` | object | Output field: raw\_json.dnssec | | `raw_json.name` | object | Name of the resource | | `raw_json.org` | object | Output field: raw\_json.org | | `raw_json.address` | object | Output field: raw\_json.address | ### Output Example `{"headers":[],"reason":"OK","status_code":200,"address":null,"whois_server":null,"registrar":null,"raw_text":"google.com","city":null,"raw_json":{"domain_name":null,"registrar":null,"whois_server":null,"referral_url":null,"updated_date":null,"creation_date":null,"expiration_date":null,"name_servers":null,"status":null,"emails":null,"dnssec":null,"name":null,"org":null,"address":null,"city":null},"name_servers":null,"emails":null,"country":null,"zipcode":null,"name":null,"org":null}` ## WHOIS Lookup Retrieve domain registration and availability details by performing a WHOIS lookup using the specified domain name. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------------- | | `domain` | string | Required | Parameter for WHOIS Lookup | | `raise` | boolean | Optional | Raise an error if the WHOIS lookup fails | ### Input Example `{"domain":"string","raise":true}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | ------------------------------------- | | `headers` | array | HTTP headers for the request | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `address` | object | Output field: address | | `whois_server` | string | Output field: whois\_server | | `registrar` | string | Output field: registrar | | `raw_text` | string | Output field: raw\_text | | `city` | object | Output field: city | | `raw_json` | object | Output field: raw\_json | | `raw_json.domain_name` | string | Name of the resource | | `raw_json.registrar` | string | Output field: raw\_json.registrar | | `raw_json.whois_server` | string | Output field: raw\_json.whois\_server | | `raw_json.referral_url` | object | URL endpoint for the request | | `raw_json.updated_date` | string | Date value | | `raw_json.creation_date` | string | Date value | | `raw_json.expiration_date` | string | Date value | | `raw_json.name_servers` | array | Name of the resource | | `raw_json.status` | string | Status value | | `raw_json.emails` | array | Output field: raw\_json.emails | | `raw_json.dnssec` | string | Output field: raw\_json.dnssec | | `raw_json.name` | object | Name of the resource | | `raw_json.org` | string | Output field: raw\_json.org | | `raw_json.address` | object | Output field: raw\_json.address | | `raw_json.city` | object | Output field: raw\_json.city | | `raw_json.state` | string | Output field: raw\_json.state | ### Output Example `{"headers":[],"reason":"OK","status_code":200,"address":null,"whois_server":"whois.markmonitor.com","registrar":"MarkMonitor, Inc.","raw_text":" Domain Name: GOOGLE.COM\r\n Registry Domain ID: 2138514_DOMAIN_COM-VRSN\r\n R...","city":null,"raw_json":{"domain_name":"google.com","registrar":"MarkMonitor, Inc.","whois_server":"whois.markmonitor.com","referral_url":null,"updated_date":"2019-09-09T15:39:04Z","creation_date":"1997-09-15T07:00:00Z","expiration_date":"2028-09-13T07:00:00Z","name_s...` ## WHOIS Lookup by IP Perform a WHOIS lookup for a specified IPv4 or IPv6 address and return parsed registration and ownership details. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------- | | `ip` | string | Required | An IPv4 or IPv6 address. | | `raise` | boolean | Optional | Raise an error if the WHOIS lookup fails. | ### Input Example `{"ip":"107.170.254.17"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | ----------------------------------------- | | `headers` | array | HTTP headers for the request | | `headers.file_name` | string | HTTP headers for the request | | `headers.file` | string | HTTP headers for the request | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `nir` | object | Output field: nir | | `asn_registry` | string | Output field: asn\_registry | | `asn` | string | Output field: asn | | `asn_cidr` | string | Unique identifier | | `asn_country_code` | string | Output field: asn\_country\_code | | `asn_date` | string | Date value | | `asn_description` | string | Output field: asn\_description | | `query` | string | Output field: query | | `network` | object | Output field: network | | `network.handle` | string | Output field: network.handle | | `network.status` | array | Status value | | `network.remarks` | array | Output field: network.remarks | | `network.remarks.title` | string | Output field: network.remarks.title | | `network.remarks.description` | string | Output field: network.remarks.description | | `network.remarks.links` | object | Output field: network.remarks.links | | `network.notices` | array | Output field: network.notices | | `network.notices.title` | string | Output field: network.notices.title | | `network.notices.description` | string | Output field: network.notices.description | | `network.notices.links` | object | Output field: network.notices.links | | `network.links` | array | Output field: network.links | ### Output Example `{"headers":[],"reason":"OK","status_code":200,"nir":null,"asn_registry":"arin","asn":"14061","asn_cidr":"107.170.192.0/18","asn_country_code":"US","asn_date":"2013-12-30","asn_description":"DIGITALOCEAN-ASN, US","query":"107.170.254.17","network":{"handle":"NET-107-170-0-0-1","status":["active"],"remarks":[{}],"notices":[{},{},{}],"links":["https://rdap.arin.net/registry/ip/107.170.0.0","https://whois.arin.net/rest/net/NET-107-170-0-0-1"],"events":[{},{}],"raw":null,"start_address":"107.170.0.0"...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |