IP2WHOIS

An enterprise trial request arrives. Before any seat is created, the agent calls Look Up Domain WHOIS on the email domain and reads the creation date and domain age in days. Domains older than a year with a named registrant organisation are approved automatically, and the organisation and country are written onto the account in Pipedrive so the rep does not have to research the company. Domains under thirty days old, or with every contact block redacted, are held. The agent is not deciding these are fraudulent. It is deciding they are not obviously fine, which is a different and much more defensible judgment.

A scheduled flow walks the list of partner, vendor and defensive brand domains once a week and calls Look Up Domain WHOIS on each. It reads the expiration date and the EPP status codes, and raises anything expiring inside ninety days or carrying an unexpected status such as a pending delete or a transfer prohibition that was not there last week. The findings go to the operations channel in Slack with the registrar name and URL attached, so whoever picks it up already knows where to log in.

A security investigation starts with one hostile address. The agent calls Get Hosted Domains and pages through the results using the reported total page count, collecting every domain served from that address. It then runs Look Up Domain WHOIS across the returned domains and groups them by registrar and creation date. A cluster of domains registered within days of each other at the same registrar tells a very different story than three hundred unrelated small sites on a shared host, and the grouped output makes which one you are looking at obvious at a glance.