Chapter 03 of 04 · Reconnaissance

whois

What a registry holds, how stale it is, and why it is not the machine.

One-sided — A whois lookup queries a registry, not the target. There is nothing in the target's logs to detect and nothing for it to defend — which is exactly what makes it the first thing an attacker does, and is worth saying rather than inventing a defensive beat for.