Domain names, WHOIS, and public DNS

02An address and a registrant line are different facts

Read each field according to its job. A name-to-address mapping may point to shared infrastructure, and registration may name an organization or withhold personal details. Neither should be promoted into a verified human attribution without suitable supporting evidence.

The names ending in .example and the 192.0.2.x addresses are documentation labels. Treat them as fiction and do not query them. The organization name in this packet is also a story label. REDACTED means a value is withheld, not that its missing content can be inferred.

1lamp.example A 192.0.2.44
2Reading: the supplied A record maps this name to that IPv4 address.
3Human owner: not established by this address mapping.
4No resolver query, registration lookup or contact was performed.

03Copy the activity address

Use desk.example for the guided case. Copy addressing and registration to separate lines with their source filename.

Label: original fictional DNS and registration table. Not a live resolver response. Not an RDAP response.
Do not query these names.

Worked name: lamp.example
A record: 192.0.2.44
Registration line: not used on the worked card.

Activity name: desk.example
A record: 192.0.2.50
Fictional registration: registrant REDACTED, organization Night Desk Club, marked fictional.
The organization line is a story label. It does not identify a human.

Stage 07's server dc-1 remains an Active Directory domain controller.
desk.example is a DNS name. The two uses of the word domain are different.

Label: activity rows for the DNS lesson. Original fiction.

Read desk.example. Write the A-record address from fictional-domain-records.txt.
Predicted address: 192.0.2.50.
Write the registrant word: REDACTED.
The A record and the registrant line answer different questions.

1. Find desk.example and copy its A address 192.0.2.50.
2. Copy the registration field as registrant REDACTED and the fictional organization label without filling a personal name.
3. Write the questions those lines answer: where this saved mapping points and what the fictional registration record discloses. Leave human ownership unknown.
4. Stop at the saved table; no DNS, WHOIS or RDAP request is required.

04Stage case

Spend about twenty minutes on the five-source stage case. Cite notices, scope, the saved page/memo, the sign/map model and the DNS/registration table. For each, separate the source statement from a confirmed conclusion and state a limit. Add a closing evidence note explaining why method choice follows provenance: declared transforms use their given rules; artifacts need preserved originals and appropriate readers; research stays inside its fictional corpus.

This closes the OSINT module and connects the stage’s three methods. A successful transformation, a matching signature or a repeated claim each supports a different kind of conclusion. The next First CTF stage uses these habits on a small owned board; it does not require you to investigate anyone or perform a live lookup.

Label: ungraded OSINT module case and stage close. About twenty minutes. Keep a cited evidence note.
Use only this packet. No live lookup. No real person.

Write these five lines:
1. Notices N3 and N4 both place the spare cable in drawer 2. N1 and N2 disagree on the room time.
2. The fence allows Ada North's packet profile. A classmate's page stays outside.
3. The saved page shows the phrase night desk. Memo M2's copper bell is absent from that page and present in query-notes.txt.
4. The sign sentence supports square L4. The typed GPS square is M9.
5. desk.example has A record 192.0.2.50. The registrant line reads REDACTED.

Then write four limits, one each:
- A notice can be wrong even when two copies agree.
- An empty search of one page is not proof that a memo is missing from the packet.
- An editable location line is a lead.
- An A record maps a name to an address. A redacted registrant line does not name a human.

Stop. Do not open a registrar, a search engine, or a classmate's account.
End with a note connecting declared transformations, preserved artifact evidence and source-limited research.

05Optional challenge

In about ten optional minutes, compare a copy of the fictional table with a hypothetical later version whose A address changed. Record the differing values and version times as two saved observations. Explain why neither observation alone settles who controlled the name at all times. No live lookup is needed.

06Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Source file label: cedar-records.txt. No DNS, WHOIS or RDAP query is performed.
D1 cedar.example A 192.0.2.78
D2 registrant: WITHHELD
D3 organization: Paper Cedar Club, a fictional story label
The documentation address is not a target. No human identity is supplied.

A saved DNS A record maps archive.example to an IPv4 address.
A fictional server called dc-paper holds Active Directory account and group records.
No directory grant or human attribution follows from a DNS address mapping.

07Explain the evidence and its limit

Optional self-check: close the stage with one sourced transformation, one preserved-artifact hypothesis and one bounded research claim.

Review it: cite input and method, separate observations from full-reader or source confirmation, keep DNS addressing distinct from registrant and directory roles, and stay inside the fictional corpus.