secynic / ipwhois

Retrieve and parse whois data for IPv4 and IPv6 addresses
https://ipwhois.readthedocs.io/en/latest
BSD 2-Clause "Simplified" License
555 stars 121 forks source link

Incomplete network events information in lookup_rdap() #188

Closed SalmaanP closed 7 years ago

SalmaanP commented 7 years ago

I was interested in finding domain registration date of certain domains and did this but it didn't have the registration timestamp in it.

 >>> IPWhois('77.88.55.60').lookup_rdap(depth=1)['network']['events']

[{'action': u'last changed', 'timestamp': u'2014-03-26T09:17:12Z', 'actor': None}]

While if i do this for another IP I do get the registration information.

>>> IPWhois('74.125.225.229').lookup_rdap(depth=1)['network']['events']

[{'action': u'last changed', 'timestamp': u'2012-02-24T09:44:34-05:00', 'actor': None},

 {'action': u'registration', 'timestamp': u'2007-03-13T12:09:54-04:00', 'actor': None}]

Any idea why this happens and how to get registration date for domains?

secynic commented 7 years ago

For the first IP, 'last changed' is the only event provided by RIPE: https://rdap.db.ripe.net/ip/77.88.55.60

Legacy Method

You can get the registration info 'created' via legacy whois.

'created' for smallest subnet

from ipwhois import ipwhois
result = ipwhois.IPWhois('77.88.55.60').lookup_whois()
print(result['nets'][-1]['created'])

The result shows a bug for the value in result['nets'][1]['range']. This should be checked for CIDR and converted to 'start_ip - end_ip'.

secynic commented 7 years ago

Merged in #189