---
title: Do you have examples of how I can use DRS search tools?
description: Do you have examples of how I can use DRS search tools?
---

[Skip to content](https://knowledge.whoisxmlapi.com/do-you-have-examples-of-how-i-can-use-drs-search-tools#main-content)

English

Show submenu for translations

![Logo inline notagline (1)-1.png\]](https://knowledge.whoisxmlapi.com/hs-fs/hubfs/Logo%20inline%20notagline%20(1)-1.png?height=40&name=Logo%20inline%20notagline%20(1)-1.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- Go to whoisxmlapi.com

 Go to whoisxmlapi.com

 What do you want to know?

- There are no suggestions because the search field is empty.

1. [Knowledge Base](https://knowledge.whoisxmlapi.com/?hsLang=en)
2. [Domain Research Suite (DRS)](https://knowledge.whoisxmlapi.com/domain-research-suite-drs-1?hsLang=en)

# Do you have examples of how I can use DRS search tools?

Yes, please see below for an overview of the ways you can use DRS search tools.

#### **Table of Contents**

1. [How to Verify the Legitimacy of a Domain](https://knowledge.whoisxmlapi.com/do-you-have-examples-of-how-i-can-use-drs-search-tools#how-to-verify-the-legitimacy-of-a-domain)
2. [How to Uncover Artifacts Connected to Publicly Available IoCs](https://knowledge.whoisxmlapi.com/do-you-have-examples-of-how-i-can-use-drs-search-tools#how-to-uncover-artifacts-connected-to-publicly-ava)
3. [How to Identify Live Counterfeiting Sites](https://knowledge.whoisxmlapi.com/do-you-have-examples-of-how-i-can-use-drs-search-tools#how-to-identify-live-counterfeiting-sites)

### **1. How to Verify the Legitimacy of a Domain**

To check the legitimacy of the domain, such as appleid666666\[.\]com, you can compare its WHOIS record with that of the known company’s official domain—apple\[.\]com. Here’s how.

1. Go to [**WHOIS Search**](https://tools.whoisxmlapi.com/whois-search)**.**

 2. Type the copycat domain name into the search field and click Search to retrieve the domain’s WHOIS record.

![](https://lh6.googleusercontent.com/4d_7xcr2YWhqtYH5rT2eFAyPmK5ERzqxFGKK1ge6bwDzm0xDB-pkc-jh99C1HYaQaPVLhXCMrnzC0_nw5F13jiEBHIUvNr1eWhDqAzldGFAwhOSb7Kc21YgKoKkfV3uqTWU5s4yp3N5Zc3HPie3dgbtshMV2GCAZvnZGT1MAKlpFEPq7fS1ApX5gLQ)

2.1. Scroll down to check the domain’s age.

![](https://lh4.googleusercontent.com/d50uuidVqQoNho6ZnTif7dZEdJhknZSJkLbEhkTXxK7GdlsGhz6adXJSltZ-s3VYoJ-v-1Dhh6EAcLIEQJdxxyuzVwD11CCpvHX5rkX5W8Ew6edBce3dREUmpdKMPaDrxSyb7kEJc1yh1aL6PUejjn2zCxnG3FXIWBhAboJCJfyVYv1Q0RdlimgUew)

2.2. Scroll down further to check the domain’s current registrant contact details.

![](https://lh5.googleusercontent.com/PIHveBNYn_WAYve1WJPy-XpvdxTWs89WX75e0TTeGA_0UUgb4s8LttnZ2dAVEW91mJ7o3DSSn9z8AmPUGdBVks7buf5s9_GOaO7lZrJ2CpJ_NnqfVSfFqAFO7PYVNIq_xmpPyQzmqkW22nDrjxNYdR_y52CrJe8A0ncs2tn47PduxN9q2n1kYz4QxA)

3. Type the legitimate domain name of the company and click **Search** to retrieve its WHOIS record.

 

![](https://lh4.googleusercontent.com/7Zqbu45sElUhAqN3BwnAOpZfbSvsHFt8_JI-F7Lo1ARI6hb0tS7JNHb4brsaxOrBkF2R_oyzYdJwFLQHtfjG-7dScOFXcLIJh_t8Xc5UiMuI4d8jIArbvnVoEuuzF9AQ7bQ8c6RVkASVk3w1hLCdOEodJTXXGQEz9NBV0r1M10F9jGHiLBfsugotsQ)

3.1. Just like before, scroll down to check the domain’s age.

![](https://lh6.googleusercontent.com/GPbccIUXrkniLL2-0kckENzLgqzY-1ay0zU3TK6e8a6L8jruvzm6yAPAV_g06ZGP6ylvm8lpaq4GdDFauiEJSsq_iZC_MDBKCUsxPHq--4kNwDdaTu5b_deoUSS2VuXJRkUBhXWINE6cdGxTaOYQA5I3bvHJvp5WQUKpnGlPxqbC2nFXEyUASo-LeQ)

3.2. Scroll down further to check the domain’s current registrant contact details.

![](https://lh3.googleusercontent.com/_djRHLkqvoVQW3GKvyAYAq4lCOKi8KOIbmBVkUe231ld_lrkXfnv88rJT1ibNbNuQX09OVPtDmOIcgu_rFAAQHpArGeE54zHP0yPwb2eJ5gQhZLaVMnGznUvMz7RNfRVhzliLQ2PUekIj4Kn_FSDrdIKVqb7xyNJbie5AeNrlFusCP8umms340GK5g)

 4. Comparing the bits of information gathered so far for the two domains, you can take note of the following:

- **Major difference in domain age:** Most brands like Apple have held their business domain for years. Copycat domains, on the other hand, are often registered much more recently.

- **Registrant contact detail redaction:** The presumably copycat domain has redacted registrant contact details. The legitimate domain’s, however, has the business details of Apple, Inc.

 5. **\[BONUS Pro Tip\]:** You can also download WHOIS Search reports as PDFs to keep a record of your query by clicking the **Download PDF** button.

![](https://lh5.googleusercontent.com/BEo03uLjDDsU8AMNuz7iT_bp-9szk4TrHi1qfJra9-h695ycxsIGu8J5l4j8z8IdR5z1l3SEu6NzQg2Y8MVy-Ftn6tlKQmEMFE-Z9VI9IqBFn696kiifb83UXOC0U8Da5pScfKTHjfKHkjtusGLsSthycisP8UEK0H1IveqHWCiwQAuYLaHMERpjYw)

### **2. How to Uncover Artifacts Connected to Publicly Available IoCs**

#### **Via WHOIS**

By scrutinizing WHOIS details, you can find more domains connected to a publicized IoC linked to Roaming Mantis, such as xpddg\[.\]com.

1. Go to [**WHOIS History Search**](https://tools.whoisxmlapi.com/whois-history-search)**.** Most domains have redacted current WHOIS records, but WHOIS History Search can reveal their past—and still public—ownership details.

2. Type the IoC into the search field and click **Search.** You can also download the whole report by clicking **Download PDF.**

![](https://lh6.googleusercontent.com/BCW4hyzHZjf8wyou-pOIe4OkRFqyxUxduFQpKyin83t8t3Dw7xPwJUKXuHJ-cmE1CAZWAY4fewzsrC5O80DEYUpCJiBb2foC_6ZTnohw90tivt4CTq4_wEmoP-rWL0rfGFGY25pNJrG-zNIUnaUT4P-SoBHMuhG0ucU7uXu7O50VKZLHSwJZ9rbDcw)

3. Open a historical WHOIS record by clicking a specific date.

![](https://lh5.googleusercontent.com/9_5vnemHLTnDr610w3wn_Yrlr3ErqtoDrfx9GlFXGzBEtAikZcxj-NNrZkI_EU1h1a_TwIw7Spe32JnQtbRhEYGgeuXBQSL5RXwogSe_SLlIdAcFLPcxLqZOzzMP9jJBsxtoBKr026nUXbZ6OaZmpuTYUumeTBauBCF_s6kEgyVXgUEV6eQKJ1R93w)

 4. Look for unredacted registrant information from among the available historical WHOIS records.

5. When you find one with the details you’re looking for, click the record and choose **Build current Reverse WHOIS report.**

![](https://lh5.googleusercontent.com/BQMqqDJLlZmG6mZofkWPcH8v7TMsLg6PlJARk-toiqEtleXrl63WrCbVHSDw39Ioj29i69nLoZZahLjLzW2cOi_Bss92yw94vH9gRNRLzeq27_U6NkL_W-T2q-KoM2ZB62eTpmkv_TsRmV-rtMUvkNtgadcXfT2zr9GyXoesu319oJHcS1u2CqfVKw)

This will give you a list of domains currently registered using the specific WHOIS record detail.

![](https://lh6.googleusercontent.com/17SsPlmt9WjwTy_7uvg2hsy8uyAyrheCfjY1RRqve4l99U-w6Dutj7shsY150DghaCmlDwITkfVQ6NHo46luSvN6FaAJl4iu4RDSChOPdCFqO-y55UdmFxzB5TL23UNHt1A_BIPTw5JgX6FiBeNO12hlspyKyW-8ZgxBQ5PXB4GGiE_iczcfPI4BlA)

 6. Alternatively, you can also select **Build historic Reverse WHOIS report.**

![](https://lh4.googleusercontent.com/KtRsUnyJNLhDmaT4thzTt8p7o4tNJ_bkZVCanA-T_eYU_ZUGvlkuiMDfsfzXy9-A793SaRVQ-hWXofvl2-DH8PQeglFBwLzjsK9km8xlTruPVRBItGJT8GNxUKyBJtlwQ2ClO0naeuide8DV2QlWn1R9Y2cpBIm_SWnNTlqBPuzTSRhEMTr3Jj4Hhw)

That way, you will retrieve domains that contained that particular email address in their previous WHOIS records.

![](https://lh3.googleusercontent.com/SBnq_tqw7-ob1mdR5XK5PBfQq8N3feWrtBDY41W363NTV5VvbOJAiPmhRBePOlAimjILO-jlAbIqLCDcN2zlSS-IaDCjozAN2EjTDbWFRkbPdDJID3oLvsmnh9vdXjcmtA8joSlvXcCtb73bHYGjk-e97c88E27Kn3J9J2pxjuNaXOAYjpg9QU44xw)

 7. **\[BONUS Pro Tip\]:** You can use [**Reverse WHOIS Search**](https://tools.whoisxmlapi.com/reverse-whois-search) if you already have a registrant detail like an email address for which you’d like to find associated domains.

#### **Via Reverse IP/DNS**

Using the same Roaming Mantis IoC as a starting point— xpddg\[.\]com—you can:

 1. Go to [**Reverse DNS Search**](https://tools.whoisxmlapi.com/reverse-dns-search)**.** By default, you will land on the **Obtain connected domains** tab.

2. Type the IoC into the search field and click **Search.**

![](https://lh6.googleusercontent.com/3KyJGWBznQltpzB1qS2z4vsxs39XNOwETwrExIUWg1Y1pI6yxtvUGCS0yuhRvL4XAQPSfQS8wetP1R8WS02Ke2Nw9vJhUvkMm5XBnjGmpnZjEfTfX7AHkDyet6mtdH0IMFVCLoR_wgUx8x5uNvKBdky-_K59j6KxnXld3VkPNCHuA0DkuQsQgWu0ug)

 3. The tool will return a list of domains hosted on the same IP address as the IoC.

![](https://lh5.googleusercontent.com/axXUA0Ic2eE-CJaT5UCVLwkZqoH6hbtXaVW9ZJfUShQ_SvqIhvm3s7OawA0ItaAd1n7Bb_QJua-jBWkDDxOpG4L34xUyyyDONSp09K0FDjK_C6hPOvwMI5IKWM8nVs79ArPF3JLk_Tq6ogC9Jwinx3rPr7G37ez0D-fdI3EYP3eg7Bb2qVw9xLgDlg)

What if the IoC you have is an IP address? You can retrieve connected domains using another Roaming Mantis IoC—142\[.\]0\[.\]136\[.\]50. From there:

 1. Go to **Reverse DNS Search** and click **Search by IP address.**

2. Type the malicious IP address into the search field and click **Search.**

![](https://lh3.googleusercontent.com/dt0KplJa1jlVxRaBG0uR9qOVR2NLvfsi3DGjF5T5SRQ9UqbRs4C1pmMLUtVPcSdEcEvVzp24Bpj5paAMxdyRUDNYFG_9ZI_cnNZEneG7nsqO_IKr90MQ8sYUOONenx9p01u7osQDdMacIVZkV92XhuLvNdvz6N2BYirTIdTle7djsYB7-o1aECaGZw)

 3. You will see a list of domains and subdomains resolving to the IP address.

![](https://lh3.googleusercontent.com/7V-14nIQfHi40FoBCu7lbZ3qlAAj_GTPart32ynuLjZjlpoF0m_Eo9B2NRoO70xIMZSGewkuYETlxhyqCK7EqLen4NCJHc0BwjTSQZ7P2ALlTeyw25oVkKU0OaJOvitr7r4vY_Ajq3qfyKMgfBVpjsx9uDUvGQpGvQbrc7UCQGzgzQF6Vyy2_-jYOQ)

Following similar steps, you can also use Reverse DNS Search to find domains connected to a given mail or name server.

### **3. How to Identify Live Counterfeiting Sites**

The search for counterfeiting and phishing domains begins by uncovering the imitators’ playground for targeted brands, such as Prada. To do that, you can:

 1. Open [Domains and Subdomains Discovery](https://drs.whoisxmlapi.com/domains-subdomains-discovery) and search for domains containing “prada” that were added since 1 March 2022.

![](https://lh5.googleusercontent.com/dHa0RM9-nDgFP9mNVwO0aEjIxBesK2HERXT9dVKTFpnDe8HYMHSTgtU1cu5GimWk4dA1vj3EYxyiZKuN22XznZGBNBB7NGlXd7_9L0vKMK3ewQom9j-DDVO18Ct0j1-ZEgQ2lcRlmu_lPm3hyhbvLFNwxHqOK3WA0aB34nZJi5NVct-jiYDVBwNcaQ)

The tool returned 963 domains.

![](https://lh3.googleusercontent.com/mGjscZA7qdq6qQ0Xz-BIVt71KUi6uRP4tAWjGGFHd0BU7Aw8ckhNxPgJXhueefbPPBQOrleoSOYdn2dUxPUHXpObUEEXFUhelD6E4IWgsgOXfwFB1f_aIIX8Qrf1DXFunSpfcGWRVF2D9DgcS2aMsGUJrHqTGNJwFC0mKLmD5FKrKcYdexWYN4_zsA)

 2. You can then narrow down the results to live and active cybersquatting domains through trial and error. Click the arrow next to a cybersquatting domain and select **Build WHOIS report.** We did this for several domains until prada-italia\[.\]it was found to have a website screenshot preview and additional site information.

![](https://lh3.googleusercontent.com/11ZZ6HIBZLQTont6ZiXhygN8JAHcpGVpvTD-f-Qa3UIK3uKLZDORcuWsWkfTnMjCdFic7PYdD8CiklwDOXLiUSqxQE5nVaoCukuEosLWWuXPsEj63f_qytzed1zg437_vZoX1U5AkXxA6gZ3B4YlTGHAl014qtWgtl5F_031jHLZLMS-oq4QVQ9gdQ)

2.1. At the top of the WHOIS report, the screenshot for prada-italia\[.\]it indicates it is a live website that hosts content (at the time of this writing).

![](https://lh6.googleusercontent.com/vNuiHSFUA4u_CUjhctJ2gKMPKKFHf03-3YmlYdIknugW1N7p7ITwdGwZHTa5ke9aWILcJRXOVQcq8OjBo3CM-MgECv_GZaHEAkqFFUcE6gV3tUosZOBfFcZN1Zo_JPlwQh3DbdB6rgTmvRv5rrDZmNnCMdU6CzpY5MOd27_TlWpwWMyZ2vGq0UYPyw)

2.2. Scroll down and check the domain’s metadata to learn more. Here, you may notice that the domain has associated information from the website contacts and categories boxes.

![](https://lh4.googleusercontent.com/0kU71d5qIaYDqT1D4ZQg6mLXtZ3SK6gzZBNTo_kwEcoIIu9bPmtDk3uhK8lx_yW_4fMSSeeaaXzsdIG72kdbXIw8_a4A0MY1CZcRHbDHwgxWueZ47F3YxZRA5xG9m8cxLTICRldHi1iWiZql0IssoHwUH39VRSZLEps_HX_T0e4peoVGLdAZfHpulg)

 3. How does this domain information compare with that for Prada’s official domain? To check, go to [**WHOIS Search**](https://tools.whoisxmlapi.com/whois-search)and type prada\[.\]com into the search field. You can then:

3.1. Check the website screenshot.

![](https://lh5.googleusercontent.com/FHERE8bw3RsISG8awCL2ZY-S6S1977iP_lKYHDwVybJQqWavAVjWjWdHvCfhKQhECeGJo9j2UHIjVxbRfEzeZF1OwNkqX4dXTrY3YqM2R9DZvQLuOwHEo2vJ1g_HEPXezBjygYaEkx4XUxMJCDx6oZlPm5HGKaEIqWHkq48qodanIt03AxqLO3qj2A)

3.2. Scroll down to see the website contacts and categories.

![](https://lh5.googleusercontent.com/ELzUq-gsEYTEqG5XjSFJZgJC8FvpFDt17AOKaYqRA7rUHFKOinwoz_Fdo_EQeSiXRzTIXIlhpvYq2tYX6OvzVONYkzmia43elRPdmg8MBpZjMzKQHO2aIaq2z9ONWPfURFAO-wJWeK1nF0xz7tGMvHgdwCJSp1PMirsZbmQaIF_N_Cptr2Y3ZyfCNg)

 4. Compare the website screenshots, contact information, and categories of the cybersquatting and the official Prada domains. It’s interesting to note how similar these are, possibly indicating that the imitator did a good job at mimicking the business.

5. Following the steps specified in [1. How to Verify the Legitimacy of a Domain](https://knowledge.whoisxmlapi.com/do-you-have-examples-of-how-i-can-use-drs-search-tools#how-to-verify-the-legitimacy-of-a-domain), you can compare the WHOIS records of prada-italia\[.\]it and prada\[.\]com and notice that their domain ages and registrant information differ—the latter being a much older domain with public WHOIS record information and the company name mentioned.

6. **\[BONUS Pro Tip\]:** In addition to the WHOIS details specified in [1. How to Verify the Legitimacy of a Domain](https://knowledge.whoisxmlapi.com/do-you-have-examples-of-how-i-can-use-drs-search-tools#how-to-verify-the-legitimacy-of-a-domain), WHOIS records can reveal the cybersquatting domain’s backend infrastructure and registrar details in case you want to file a complaint. Here is what we found for prada-italia\[.\]it.

![](https://lh6.googleusercontent.com/B4F_AiF23Dxfh4sXRRrBvQ3HgB5EyyAKPYIGzElXO5xQZrc8m69KByh7LuPto6bM2rg6VqAPpMNjRId8NcpAenc3u5vPDAFwHO8BzMDUdwbnowiloyQabiglhA2AzmC3qo5zBt6TqBZCUZ7rv3I47zSp8NoJKOBtNZ83T8wWPTfV6_nsoiIYDpMxhQ)

***Your turn to have fun with the Domain Research Suite (DRS)! You can access the tools mentioned in this post*** [***here***](https://tools.whoisxmlapi.com/)***.***

- [NRD2](https://knowledge.whoisxmlapi.com/nrd2?hsLang=en#main-content)
  
  
  
  
  
    - [Tutorials](https://knowledge.whoisxmlapi.com/nrd2?hsLang=en#tutorials)
- [General Support](https://knowledge.whoisxmlapi.com/general-support?hsLang=en)
- [WHOIS Domain Data](https://knowledge.whoisxmlapi.com/whois-domain-data?hsLang=en#main-content)
  
  
  
  
  
    - [WHOIS vs. Historical WHOIS](https://knowledge.whoisxmlapi.com/whois-domain-data?hsLang=en#whois-vs-historical-whois)
    - [Quarterly feeds](https://knowledge.whoisxmlapi.com/whois-domain-data?hsLang=en#quarterly-feeds)
    - [WHOIS data fields](https://knowledge.whoisxmlapi.com/whois-domain-data?hsLang=en#whois-data-fields)
    - [Bulk WHOIS Lookup](https://knowledge.whoisxmlapi.com/whois-domain-data?hsLang=en#bulk-whois-lookup)
- [DNS Data](https://knowledge.whoisxmlapi.com/dns-data?hsLang=en)
- [APIs](https://knowledge.whoisxmlapi.com/apis?hsLang=en#main-content)
  
  
  
  
  
    - [WHOIS API](https://knowledge.whoisxmlapi.com/apis?hsLang=en#whois-api)
    - [WHOIS History API](https://knowledge.whoisxmlapi.com/apis?hsLang=en#whois-history-api)
    - [DNS Lookup API](https://knowledge.whoisxmlapi.com/apis?hsLang=en#dns-lookup-api)
    - [IP Geolocation API](https://knowledge.whoisxmlapi.com/apis?hsLang=en#ip-geolocation-api)
    - [Email Verification API](https://knowledge.whoisxmlapi.com/apis?hsLang=en#email-verification-api)
    - [Domain Reputation API](https://knowledge.whoisxmlapi.com/apis?hsLang=en#domain-reputation-api)
    - [Subdomain Lookup API](https://knowledge.whoisxmlapi.com/apis?hsLang=en#subdomain-lookup-api)
    - [Reverse WHOIS API](https://knowledge.whoisxmlapi.com/apis?hsLang=en#reverse-whois-api)
- [Databases / Data Feeds](https://knowledge.whoisxmlapi.com/databases-data-feeds?hsLang=en#main-content)
  
  
  
  
  
    - [Threat Intelligence Data Feeds (TIDF)](https://knowledge.whoisxmlapi.com/databases-data-feeds?hsLang=en#threat-intelligence-data-feeds-tidf)
    - [IP Geolocation / IP Netblocks Databases](https://knowledge.whoisxmlapi.com/databases-data-feeds?hsLang=en#ip-geolocation-ip-netblocks-databases)
- [Legacy](https://knowledge.whoisxmlapi.com/legacy?hsLang=en)
- [Dev & Data Science Corner](https://knowledge.whoisxmlapi.com/dev-data-science-corner?hsLang=en#main-content)
  
  
  
  
  
    - [Dev resources](https://knowledge.whoisxmlapi.com/dev-data-science-corner?hsLang=en#dev-resources)
- [Domain Research Suite (DRS)](https://knowledge.whoisxmlapi.com/domain-research-suite-drs-1?hsLang=en)
- [IP Data](https://knowledge.whoisxmlapi.com/ip-data?hsLang=en)

[![Chill listening crop-3](https://knowledge.whoisxmlapi.com/hs-fs/hubfs/Logo%20eye%20icon%20(1).png?width=37&height=24&name=Logo%20eye%20icon%20(1).png "Chill listening crop-3")](http://whoisxmlapi.com)

Copyright © 2026, whoisxmlapi.com