---
title: "Comment by Furqan Ashraf on \"How Hackers Find Information About a Website — An Introduction to Reconnaissance\" | Hashnode"
description: "Good breakdown of passive vs active recon. One thing worth adding to the passive side: WHOIS lookups are still one of the most useful OSINT sources, even with p"
url: "https://hashnode.com/posts/web-reconnaissance-website-information/6aa658357746efbe32dbc228/comment/6aa8159388a2b4baad815202"
---

[Discussion](https://hashnode.com/posts/web-reconnaissance-website-information/6aa658357746efbe32dbc228)

Comment [How Hackers Find Information About a Website — An Introduction to Reconnaissance](https://hashnode.com/posts/web-reconnaissance-website-information/6aa658357746efbe32dbc228)

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Sep 14](https://hashnode.com/posts/web-reconnaissance-website-information/6aa658357746efbe32dbc228/comment/6aa8159388a2b4baad815202)

Good breakdown of passive vs active recon. One thing worth adding to the passive side: WHOIS lookups are still one of the most useful OSINT sources, even with privacy redaction becoming more common.

What WHOIS still reveals:

Registration and expiry dates, useful for spotting recently registered domains tied to phishing or fraud infrastructure Registrar and nameserver history, which often exposes infrastructure relationships between domains Historical WHOIS records, which can connect a domain to earlier ownership even after a privacy service gets added later

For teams doing this defensively, checking your own domain portfolio through something like WhoisFreaks is a quick way to catch expired registrations or nameserver drift before they become findable by someone else. Fits right into the "what does our external footprint look like" question you raised.

[Faiz Hussain](https://hashnode.com/@faizhussain)

[Sep 30](https://hashnode.com/posts/web-reconnaissance-website-information/6aa658357746efbe32dbc228/comment/6aa8159388a2b4baad815202#reply-6abd0dd218788c2f641f604b)

Absolutely, that’s a valuable addition. WHOIS can still provide useful context even with increasing privacy redaction, particularly around registration dates, nameservers, and historical domain information.

I agree that checking these details as part of regular external attack-surface monitoring can help organizations identify changes or overlooked assets early. Thanks for adding this perspective to the discussion!

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Oct 5](https://hashnode.com/posts/web-reconnaissance-website-information/6aa658357746efbe32dbc228/comment/6aa8159388a2b4baad815202#reply-6ac34846da45fcf6b91cde1f)

Thanks Faiz, glad it fit the discussion. One more angle on monitoring: setting up alerts for newly registered lookalike domains (typos, swapped TLDs, brand + "login" or "support") is worth doing too. Those usually show up in WHOIS and DNS data days before a phishing campaign goes live, so catching them early gives a team time to file takedowns. Looking forward to your next post in the series.