First start

When you start XL-Whois for the first time, you are asked if you want to set default configuration. If you click Yes, you will be asked to select a directory where:

• 1 An empty Logging Database will be created.
• 2 An empty Whois Database will be created.
• 3 A subdirectory named whois will be created and selected for XL-Whois reports.
• 4 The TLD Database (effective_tld_names.dat) will be downloaded if it doesn't already exist. It could exist in the XL-Parser user directory.
• 5 The Whois Server Database (tld.json) will be downloaded.
• 6 The GeoIP database (GeoLite2-City.mmdb) will be located if it already exists.
• 7 The IPv4 Database (ipv4-address-space.csv) will be downloaded.
• 8 The IPv6 Database (ipv6-unicast-address-assignments.csv) will be downloaded.
• 9 Following default options are selected:
  • Activate Logging
  • Check Logging Database
  • Store Network whois data
  • Check Whois database to "If present, ask"
  • Auto viewing for reports with a maximum of 25
  • Auto update for TLD, Whois Server, IPv4 and IPv6 databases
  • Default language is set to "En"
  • All parser options are selected: IPv4, IPv6, Hostname and Domain Name
  • NsLookup timeout is set to 10 seconds
  • Check for update of the tool at startup
• 10 A XL-Whois.ini configuration file will also be created to keep your preferences in memory. You can also set elements above manually, in case you already have some of these databases.
• 11 At the end, you will be asked if you want to send a whois test.

Main Window and tray menu

You can set options in the main window or directly from the tray menu:

• Options: XL-Whois supports three different types of request:
  • Domain whois for domain names registration details.
  • Network whois for IP addresses.
  • DNS Records which is about the Domain name.
  • GeoIP for IP addresses.
  • To be able to send a Domain whois about an IP address or to be able to send a Network whois about a Domain name, XL-Whois use system nsLookup to resolve the requested item.
• Registry: This option may be used if you want to force the network whois to be queried to the selected registry. The IPv4 Database (ipv4-address-space.csv) from IANA contains "errors" that affect whois tools. For example, 163/8 is supposed to be administered by APNIC, but 163.247/16 is administered by LACNIC. So, in this case, you will get a better answer if you force the registry to LACNIC.
• Check db: There are two databases that can be used here:
  • Whois Database: Details about Network whois (see details in the Whois Database section). There are actually four options:
    • Don't check: XL-Whois will send he request without checking the database. If an entry already exists, it will be replaced.
    • If present, ask: XL-Whois will check the Whois Database before sending the request. If an ISP is already known for the requested IP address (or resolved for the requested host or domain name), XL-Whois will show you actual data and ask you if you want to send the request.
    • If present, ignore: XL-Whois will check the Whois Database before sending the request. If an ISP is already known for the requested IP address (or resolved for the requested host or domain name), XL-Whois will ignore the request. As the whois database is updated after each request, this option is particularly useful if you have a long list of IP addresses and a probability that many of them will be in the same range, like a login history.
    • Check after: XL-Whois will send the request and extract Network whois data from the answer. If an ISP is already known for this IP address, it will ask you if you want to update the database with the new data. This option is useful if you are used to modify ISP name in the database (ex.: you can add comment like "- Tor node"). Example:
      
  • Logging Database: History of your precedent requests. This database contains the exact items you requested, the comment you add, etc. This database is your personal history. See Logging Database section for more details. When you select this option, the item will be searched in Details and Comment column of the database. If more than three entries are found, only the three most recent results will be shown.
  • If you selected both options (check whois and logging database), below is an exemple of what you will got if the requested item was found in both database:
    
• Add comment: This comment will be added to the XL-Whois Report and stored in the Logging Database. It can be anything like a file number, a project name, the reason you did the request, etc. The comment is optional. It can also be added using the Whois with comment from the tray menu. In this case, a popup will appear before sending the request:
  
• Clipboard: The input data for whois requests is gathered from the clipboard content. Obviously, it must be in text format, but it doesn't have to be a clean enumeration. XL-Whois provides an integrated parser for IPv4, IPv6, Hostname and Domain name (can be selected or deselected in Settings). You can see the result by using the Parse button, but it's not necessary to do this before sending your request, as the parser is automatically used before each request. In the clipboard window, the Edit button saves data from the textfield to the clipboard, so if you want to type an IP address or a domain name, you can do it here. The parser will enumerate items that can be requested. Duplicates will be removed from the list. Example:
  Before parsing:

  After parsing:

Send a whois request

When everything is set, all you have to do to send a whois request is select and copy text that contain whois elements (copy will send the data to clipboard), then click on whois button of the main window, or use the function from the tray menu. You can select and copy from anywhere (a text document, a spreadsheet, a web page, etc.). Example from a spreadsheet:

Right-click on XL-Whois tray icon:

In the tray Whois function, only the first item is displayed. If there are more than one item, a 3-dot (...) is added at the end as the example above.

When you send the request, XL-Whois will use nslookup (if necessary) to resolve the IP address or the hostname depending on the requested item (if it's an IP address or a domain name). Depending on the checked options, requests will be made as following:

• For Domain whois, XL-Whois will check in the TLD Database to extract and valid the domain name (ex.: file.txt has a valid syntax but is not a valid domain name). After that, it will check in the Whois Server Database to identify the appropriate whois server for the query. If no whois server can't be found, a request is sent to Internic to identify the appropriate server. You must also be aware that, like many other whois tools, XL-Whois use the WHOIS protocol to send the request to an appropriate server listening on port 43. Some ccTLDs doesn't have this kind of server. In this case, you will have to check on the Website of these ccTLDs. For some of them, it's possible to send a http query. Examples of ccTLD that doesn't support whois request are .ar (Argentina), .pk (Pakistan) and .es (Spain).
• For Network whois, XL-Whois will check in the IPv4 Database or the IPv6 Database to find the correct registry for the IP address. If no match is found, ARIN is used by default. The first request is sent to this registry. If the answer indicates another registry, a second request is sent to this registry. When XL-Whois gets the final response, it parses the response to extract information about the ISP.
• For DNS Records, XL-Whois will query each NS server for A, AAAA, NS, MX, CNAME, TXT, SOA and PTR records.

Finally, XL-Whois will produce the report that will look like this (not a full sample below):

Settings

General

In Tool section, we have the following functions and options:

• Export Lang.ini: Use this function to translate XL-Whois GUI. See Translation for help about this functionality.
• Open user dir: This is the directory where settings are saved. Copy the content of this directory if you want to backup your settings.
• Check Update: Check on le-tools.com if a tool update is available.
• Check for update at startup: When XL-Whois starts, check on website for available update of the tool.

In General section, you have the following options:

• Choose to start XL-Whois in the taskbar (main window minimized).
• Network whois mode: By default, XL-Whois use the WHOIS protocol and send the request to the appropriate registry server on port 43. Some firewall rules on client side may block outbound connection to this port. RDAP is a relatively new protocol that use HTTP protocol on port 80 (See RFC for more details). As HTTP traffic is usually allowed by firewall, it could be a good alternative for users that can't use port 43. The support for RDAP in XL-Whois is experimental for the moment. It applies to Network whois only, but this may change in the future. Network whois report should be a bit different if you use RDAP.
• GeoIP language: The GeoIP2 database from Maxmind provides data in different language. You can set your preferred language here.
• Set the NsLookup timeout: When XL-Whois tries to resolve a hostname to an IP address or an IP address to a hostname, this is the time it will wait for the answer. Default is 10 seconds.
• Customize the User-Agent of XL-Whois: The User-Agent is used to identify the tool when requesting databases from websites.

In Parser section, you can select or deselect objects to be extracted by XL-Whois. Objects are: IPv4, IPv6, Hostname and Domain name.

Storage

The following options have to be set in this tab:

• Folder for reports: This is the folder where the whois reports will be saved.
  • Auto viewing: This option is used to open whois reports in browser (or the default program for .html file) as it go along. If number of reports is higher than the limit, reports will not be automatically open even if the option is selected.
  • If report exists, replace it: If selected, older report with the same name will be replaced. If unchecked, an incremental value will be added to the new report filename.
  • Open folder when finished: If selected, report folder will be opened in explorer at the end of the process.
• Logging database: This database is required only if you want to activate logging. See Logging Database section for more details.
• Whois database: The Whois Database is the main database where Network whois data will be saved. See Whois Database section for more details.
  • Store Network whois data: If this option is checked, XL-Whois will use a cache to store the whole Network whois response. The information will be available in the Whois Database window. The cache is in a subfolder (.\cache) of the directory where the Whois database is.
  • Store "Get related ranges" searches: If this option is checked, XL-Whois will keep a copy of all responses obtained when you use the Get all related ranges function. The cache is in a subfolder (.\searches) of the directory where the Whois database is.

Databases

In this tab, you have to set the location of four databases:

• TLD Database: This database is the Public Suffix List that come from https://publicsuffix.org. It's used by the parser of XL-Whois to identify valid domain name. This database must be regularly updated to support new or modified TLDs. Link to the database is https://publicsuffix.org/list/effective_tld_names.dat (or https://publicsuffix.org/list/public_suffix_list.dat).
• Whois Server Database: This database come from https://github.com/weppos (whois repository). It's used by XL-Whois to identify the appropriate server for the Domain whois request. Link for the database is https://github.com/weppos/whois/blob/master/data/tld.json.
• IPv4 Database: This database is the "IANA IPv4 Address Space Registry" that come from http://www.iana.org. It's used by XL-Whois to identify the registry for IPv4 addresses (ARIN, RIPE, APNIC, LACNIC, Afrinic). Link to the database is http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml.
• IPv6 Database: This database is the "IPv6 Global Unicast Address Assignments" that come from http://www.iana.org. It's used by XL-Whois to identify the registry for IPv6 addresses (ARIN, RIPE, APNIC, LACNIC, Afrinic). Link to the database is http://www.iana.org/assignments/ipv6-unicast-address-assignments/ipv6-unicast-address-assignments.xhtml.
• GeoIP Database: This database is the GeoLite2 City that comes from Maxmind. To get this database and updates, you should follow these instructions:
  1. Create an account on Maxmind website.
  2. Download the GeoIP update tool and install it in the default directory (C:\ProgramData\MaxMind\GeoIPUpdate\).
  3. Get a license key from your Maxmind account, download the config file (GeoIP.conf), copy it to the default directory (C:\ProgramData\MaxMind\GeoIPUpdate\) and create a "GeoIP" subfolder.
  4. Execute the command line tool (geoipupdate.exe).
  5. Create an automated task with Task Scheduler on Windows to update the database regularly.

Whois Database

XL-Whois use SQlite for the Whois Database. Everytime you use XL-Whois and send a Network whois request, the answer is parsed and some details are stored in the database. This includes: IP address range, ISP, Country and Date of the request. Below are explanations about the functions in this Window:

• Header functions (buttons on top of the window):

  • Export Database: Export the SQLite Database data to a text file. This file can be imported in another instance of XL-Whois.
  • Import to Database: The input file must have been created by the Export Database function. Unknown ISPs will be added and known ISPs will be modified if newer.
  • Extract whois info from a file: Network whois answer (raw format) is the same whatever the whois tool that has been used. This function uses the same parser as XL-Whois calls when it receives an answer from a whois request. Network whois data will be added to the Database if unknown, or modified if newer. You can also extract Network whois data from clipboard. You must select the Network whois data and and use copy to send data to clipboard. Then, you can use the appropriate function in the XL-Whois tray menu.
  • Analyse Database: Network whois from ARIN often contains more than one result: the specific range related to the IP address requested and one, or more, parent ranges. XL-Whois store all these IP address ranges in the database. This function helps you clean your database. You can keep more specific ranges or only keep the broader range for best performance. See window below:
    
  • Search: With this functionnality, you can search an IP address or a keyword. For IP address, it's based on IP range. For keyword, it looks at the ISP column.
  • Filter: To filter shown elements in the grid. Combination of multiple filters is supported. See window below:
    
    Filters can also be set when right-clicking on a cell of the grid. See in the next section.

• Grid functions:

  • Click: Clicking on header of each column is used to sort (ascending or descending) in alphanumeric order. Clicking on any other row will select the line. You can select multiple lines using SHIFT or CTRL like you do with other tools.
  • Double-click: If it's a green background line, it means that Network whois data is stored in cache. When double-clicking on a line, the Network whois properties window is shown as below:
    
    You can edit properties from this window. You can also get or update network whois data.
  • Right-click: Right-click on the grid will show this popup menu:
    
    • Properties: Default. Same effect as doucle-clicking.
    • Add ISP...: Show an emty Network Whois Properties window where you can add an entry manually.
    • Filter: You can apply filter (equal or not equal) using the selected cell value.
    • Find in Logging database...: This function will check in the Logging Database to find entries related to the selected range. If found, the Logging Database will be opened with the matching entries.
    • Refresh selected ISP: This function will send a whois request for each selected range to update the ISP data (it uses the first IP address of the range). If the response does not match the range in the database, the new range will be added, but the old one will not be deleted. You must do it by yourself if you are pretty sure that it does not exist anymore. You can try to get/update the network whois data or use the Get all related ranges function.
    • Get all related ranges...: The goal of this function is to get all IP ranges related to an ISP. Be aware that the related ranges are based on the ASN (originAS, aut-num, origin) or on an organisation/administrative id (orgRef, ownerid, admin-c). The first view will show results about the route, the organisation or the AS (Autonomous System).
      
      You can display the result in a formatted, treeview or raw format. Based on the source of the information (ARIN, RIPE, APNIC, LACNIC), results will be different. To get the related ranges, you must use the button on the top right corner. You can change the object of the query. When you press the button, the query is sent and the view will be changed to this:
      
      You can show and select all ranges, parent only or small only (more specific ranges). By default, netname is added to the ISP name of each range, but you can remove it using the Remove Netname button. In some cases, ISP name can be choose from a list.
    • Select All: Select all the line in the grid (CTRL+A can also be used).
    • Copy lines: Copy selected lines to clipboard. Header is always added to the selection. This allows you to easily copy your database in a spreadsheet or as text.
    • Delete lines: Delete selected lines.

Logging Database

If you activated logging in Settings, everytime you use XL-Whois and send a whois request, an entry is added to this database. The entry contains date and time of the request, the requested item, the resolved hostname or IP address (if lookup has been used and a match was found) and a comment that you provide. This database will be checked before each whois request if you set this option.

Logging Database can be opened in the Storage Tab in Settings or from the tray menu. Data from this database can also be imported or exported (right-click on any element in the grid). The Comment column is editable.

• Grid functions:

  • Click: Clicking on header of each column is used to sort (ascending or descending) in alphanumeric order. Clicking on any other row will select the line. You can select multiple lines using SHIFT or CTRL like you do with other tools.
  • Double-click: If it's a green background line, it means that the whois report is available. When double-clicking on a line, the report will be opened in your default browser.
  • Right-click: Right-click on the grid will show this popup menu:
    
    • Open report: Default. Same effect as doucle-clicking.
    • Select All: Select all the line in the grid (CTRL+A can also be used).
    • Copy lines: Copy selected lines to clipboard. Header is always added to the selection. This allows you to easily copy your database in a spreadsheet or as text.
    • Delete lines: Delete selected lines.
    • Import to database: The input file must have been created by the Export Database function.
    • Export database: Export the SQLite Database data to a text file. This file can be imported in another instance of XL-Whois.