Questions about WhoIsData-Requests and IP

Question

when I use websites (server A) like https://check-host.net/ip-info to get Whois-Data or the IP from another website (server B)...

1) ...do, generally speaking, those websites (server A) connect themselves to the website server (B) with their own server IP or is my personal IP being used to establish a connection to the server (server B) to receive whois data?

2) ...does server A/my IP (depending on question 1) really 'connect' to server B, as If I would have clicked on that website from Google, let's say? So basically, can the ISP or server owner see that the IP was on this specific server B?

This doesn't look to be a security question at all, but a DNS and whois database question. — schroeder, Jan 27 '19 at 20:27
Although the question content is not exactly the same, the answers are what you are looking for — schroeder, Jan 27 '19 at 20:30

score 0 · Answer 1 · answered Jan 27 '19 at 19:04

In case of accessing the whois data no access will be done to the website in question at all. Instead a lookup is done against some public available databases which are neither in control of target A nor server B. When using B to lookup the whois for A the lookup in the public database will be done by B though which then sends the retrieved result embedded in the HTML page to your browser.

The same is true when looking up the IP address of a hostname using DNS. DNS is essentially a distributed database with several nodes in between which cache results. Even if you do a DNS lookup for the IP of A you don't access A yourself but you only access the configured DNS resolver, which is commonly the one in your router which then forwards the requests to the ISP's DNS resolver. And in your example this is also true for server B: it will just ask its configured DNS server.

The information shown about the owner of the IP address and estimated geographic location are also not retrieved by contacting A but are looked up in public and sometimes commercial databases which might be online or even be stored locally on server B.

score 0 · Answer 2 · edited Oct 07 '21 at 07:34

The whois data for a domain or an IP is not retrieved from the server at that location, but from a WHOIS database (see RFC 3912). Hostname for IP and IP for hostname is from domain name service, and location for the server from some GeoIP database, probably cached locally on the server.

All these queries are easier to perform server side rather than inside the browser. (If you are using Chrome, you could also press F12 to monitor all the HTTP(S) connections your browser makes.)

Questions about WhoIsData-Requests and IP

2 Answers2