WHOISleuth

WHOISleuth is a local-first domain investigation and brand protection tool. It keeps registration, DNS, certificate, website, network and analyst evidence separately attributed, including unavailable and partial sources.

Use it to investigate a domain, IP address or ASN; discover possible brand lookalikes; compare domain sets; retain reviewed cases; prepare response material; and compare later observations. Scores are explainable prioritisation aids rather than automated verdicts.

View WHOISleuth  ·  Explore the demo  ·  Browse investigation resources  ·  CLI guide

The demo uses fixed fictional evidence on reserved domains. It makes no live investigation request, requires no sign-in and writes no console workspace data.

How work is organised

Start or resume work from Dashboard, then choose an analyst job:

Job	Tools and purpose
Investigate	Lookup, Discover and Bulk: inspect targets, review supplied material, find candidates and compare domain sets.
Respond	Review inbox and Cases: retain evidence, record decisions, prepare reviewed handoffs and follow up.
Assure	Monitoring and Brands: review later observations, watchlists, official scope and owned-domain controls.

The Resources hub offers worked guides; the application guide covers tools and saved work. Collection and sharing are deliberate actions. WHOISleuth prepares response material; it does not submit reports.

The separate local application can be assembled locally as an installable archive; it is not a published npm package. It runs the console on loopback, keeping records, drafts and original files in a selected plaintext folder instead of IndexedDB. Encrypted portable backups remain separate.

Privacy and safety

Ordinary retained work stays in IndexedDB in the current browser profile. Explicit network operations send only their declared bounded target or evidence classes to the relevant hosted boundary, public source or selected provider. Optional hosted monitoring is separately configured and stores only its compact application-encrypted projection. Local exports and CLI files remain under the operator's control.

The generated privacy/data-flow catalogue and JSON list exact capability data flows. See the privacy notice for retention, export and deletion.

Quick start

Requirements: Node.js 24 or later and npm. Repository verification uses the exact runtime in .nvmrc; packaged CLI smoke checks also run on Node.js 26.

npm ci --include=optional --ignore-scripts --audit=false
npm run dev

npm run dev starts the frontend only: public pages and the fictional demo work without an API server. For sign-in and collection, follow the full-stack Console setup, which runs the API and frontend in separate terminals.

For a production-style local host, create the ignored .env.local described in that guide, then build and start Express:

npm run build
node --env-file=.env.local server.mts

Keep credentials out of Git. Deployed hosts can use npm start with injected SITE_PASSWORD and SESSION_SECRET; it does not load .env.local.

The public CLI package runs locally and does not require the hosted application:

npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli -- whoisleuth --help
npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli -- whoisleuth example.test --plan --json

--plan describes a Lookup without collecting. Use Getting started for local development and browser tests, or the CLI guide for installed commands.

For changes to the project, see Contributing and the Code of Conduct.

Architecture

The application is a TypeScript modular monolith with shared domain rules, browser-local storage and separate browser, CLI and deployment adapters. The backend has no general investigation database. See architecture, current product boundaries and the threat model.

Supported public formats and current case and workspace writers are listed in the generated case portability reference. Other current writers and direct migrations are described in the portable compatibility reference.

Documentation

Document	Use it for
Application guide	Browser tools, evidence states, saved work and exports.
Getting started	Local setup, development and verification.
CLI guide and reference	Installed commands, output and safety.
Candidate review	Brand candidates, selected feeds and watchlist priorities.
Offline intake	Selected text, messages, files and source-linked findings.
Infrastructure inventory	Retained hostnames, topology and historical comparison.
Operations	Authentication, limits, optional providers, monitoring and deployment.
Architecture	Components, request pipeline, persistence and verification.
Browser-local data	IndexedDB, migration, backup, encryption and deletion.
Registry data and compatibility	Normalised registration contracts and fixture-backed support.
Generated capability contract	Exhaustive execution, disclosure, budget and failure metadata.
Privacy notice	Processing, recipients, storage, retention, exports and rights.
Release discipline	Versioning, candidate verification, delivery and rollback.

Verification

Start with the checks relevant to your change:

npm run verification:focused -- --list
npm run verification:focused

The complete gate matrix, including browser, architecture, privacy, compatibility, package and security checks, is in Getting started.

Licence and responsible use

WHOISleuth is licensed under the GNU Affero General Public License version 3 only (AGPL-3.0-only). Third-party packages, services and data retain their own terms. The trademark policy, notices, dual-use disclosure and security policy apply separately.

The software is provided as is, without warranty. Registration and technical data can be redacted, stale, partial or wrong. Use collection, contact data and response material only with an appropriate purpose, authorisation and review of applicable law and provider terms.