loading
Loading content
loading
Recon
Pivot one registrant detail into registered domains.
overview
Pass --org, --email, --phone, or --domain (or the matching list file) and Trickest returns domains registered with that detail via whoisxmlapi Reverse WHOIS. Requires --api_key.
Enable --historic when you need lapsed or transferred domains a current-only lookup misses. Tune --sleep and --maxretry against API rate limits.
Use early for footprint expansion, then hand domains to subdomain enum and probing. Prefer whois-with-ripe when you only need a forward lookup on one hostname.
use cases
Start from a known organization name or registrant email and recover every domain registered with it, turning one data point into a complete asset list.
Pivot on a registrant detail to surface domains a company owns but never links to publicly, widening the attack surface.
Enable --historic to include domains the target registered in the past, catching assets that have since lapsed or moved.
Feed --org_list or --email_list to run many reverse lookups in one node, collecting registered domains across the whole input.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| org | STRING | --org | Single organization (use * for wildcard). |
| STRING | Single email address (use * for wildcard). | ||
| domain | STRING | --domain | Single domain name (use * for wildcard). |
| api_key | STRING | --api_key | Your Reverse WHOIS API key (whoisxmlapi.com). |
| historic | BOOLEAN | --historic | Get historical domains too (default false). |
| org_list | FILE | --org_list | File containing a list of organizations. |
| sleep | STRING | --sleep | Sleep time between each request (default 2 seconds). |
| maxretry | STRING | --maxretry | Max retry on failure (default 5). |
Showing key inputs. whoisninja exposes 12 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| org | STRING | --org | Single organization (user * for wildcard) |
| STRING | Single email address (user * for wildcard) | ||
| phone | STRING | --phone | Single phone number (user * for wildcard) |
| sleep | STRING | --sleep | Sleep time between each request (default 2 seconds) |
| domain | STRING | --domain | Single domain name (user * for wildcard) |
| api_key | STRING | --api_key | Your Reverse WHOIS API key (whoisxmlapi.com) |
| historic | BOOLEAN | --historic | Get Historical domains too (default false) |
| maxretry | STRING | --maxretry | Max retry on failure (default=5) |
| org_list | FILE | --org_list | File containing a list of organizations |
| email_list | FILE | --email_list | --email_list EMAIL_LIST |
| phone_list | FILE | --phone_list | --phone_list PHONE_LIST |
| domain_list | FILE | --domain_list | --domain_list DOMAIN_LIST |
example
# reverse WHOIS by organization, include historic domainswhoisninja --org "Example Corp" --api_key YOUR_KEY --historic --sleep 2 --maxretry 5example.comexample.netexample.comexample.comstaging.example.commail.example.comdev.example.comcorp-cdn.example.com8 domains for org pivot (historic included)guidance
Use when you have one identifier (org, email, phone, or domain) and want every domain registered with it. For a forward lookup on a single host, use whois-with-ripe instead.
Forward WHOIS on one hostname via RIPE. Read an asset; do not pivot from owner to domains.
Broader attack-surface mapping with WHOIS correlation. Heavier than reverse WHOIS alone.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
An organization name feeds whoisninja, which reverse-resolves every registered domain and passes them to subfinder for subdomain enumeration before they land as an asset inventory.
Facts on this page come from the live Trickest tool library.