Official Maltego Documentation » Transform Guide » PATERVA CTAS » To Netblock [Using whois info] << (IPAddress)

To Netblock [Using whois info]


Transform Meta Info

Display Name To Netblock [Using whois info]
Transform Name IPAddressToNetblock_whois
Short Description This transform will get the netblock via the whois service (ARIN/APNIC/LACNIC/AFRINIC/RIPE)
Owner Paterva
Author Roelof Temmingh (roelof@paterva.com)
Input IPAddress
Output Netblock

Description

This transforms determines the associated network (IP range) of an IP address by doing a recursive whois lookup and parsing the resultant information. Keep in mind that in many cases smaller blocks of IP addresses are sub leased and that the whois information might not reflect this. This can easily lead to false positives. The whois information itself is stored as a property of the IP address entity (IP whois). You should always manually inspect this data to give context to results. For more information about whois see the Wikipedia entry here 1 .

Typical Use Case

Example

From the default IP address entity (for our Linode server) we can retrieve the Linode Netblock that it belongs to. The whois info for the Netblock is added as a property to the Netblock entity.

 

 

 

Continue to the Mirror: Email addresses found << (Website) page.


Official Maltego Documentation
-»
Transform Guide
-»
PATERVA CTAS
-»
To Netblock [Using whois info] << (IPAddress)

© Copyright 2017, Paterva PTY Limited