Thin vs Thick Whois Models in Footprinting

312-50v12 By islever Editorial Last updated

Foot Printing and Reconnaissance

Short answer

A The Thin Whois model is working correctly because it intentionally stores only limited registry data, requiring separate queries to registrars for complete details.

Question

A certified ethical hacker is conducting a Whois footprinting activity on a specific domain. The individual is leveraging various tools such as Batch IP Converter and Whois Analyzer Pro to retrieve vital details but is unable to gather complete Whois information from the registrar for a particular set of data. As the hacker, what might be the probable data model being utilized by the domain's registrar for storing and looking up Whois information?
  1. Thin Whois model working correctly Correct Answer
  2. Thin Whois model with a malfunctioning server
  3. Thick Whois model with a malfunctioning server
  4. Thick Whois model working correctly

Key Takeaways

The core concept tested is the operational difference between Thin and Thick Whois models; the common trap is assuming incomplete data indicates a system failure rather than a designed architectural feature of the Thin model.

This question explores the distinction between Thin and Thick Whois models during ethical hacking reconnaissance. It establishes that a Thin Whois model intentionally provides limited data, which explains why a hacker cannot retrieve complete registrar details directly from the registry.

Common mistake: Candidates often select 'malfunctioning server' options because they interpret the lack of detailed information as an error or outage, failing to recognize that limited data is the standard behavior for a functioning Thin Whois system.

Expert Analysis

Why the Answer Is Correct

A Thin Whois model stores only minimal technical data at the registry level (such as the sponsoring registrar and domain status), while the complete contact and administrative details are held by the individual registrars. Therefore, when a hacker queries a Thin Whois server, it is working correctly by design to provide only this limited subset of information. The inability to gather complete data is not a failure but the expected outcome of interacting with a Thin Whois infrastructure.

Why the Other Options Are Wrong

Options B and C suggest a malfunctioning server, but there is no evidence of downtime or errors in the scenario; the limitation is structural, not technical. Option D describes a Thick Whois model, where the registry itself stores the full set of registration details. If the model were Thick and working correctly, the hacker would have been able to gather the complete information immediately without needing to query the registrar separately.

Community Comment Notes

Community consensus strongly favors Option A. As user LordXander noted, "It is actually A because the limited information is part of thin WHOIS." Another commenter emphasized that Thin Whois "Stores only the name of the Whois server... which in turn holds complete details," confirming that the missing data resides elsewhere, not due to a bug.

Exam Strategy

When analyzing footprinting tools and protocols, always distinguish between intentional data limitations (like privacy laws or model architecture) and technical failures. If a tool returns partial data consistently, consider if the underlying system (e.g., Thin Whois) is designed that way before suspecting a malfunction.

Frequently Asked Questions

What is the difference between Thin and Thick Whois?

Thin Whois stores minimal data (registrar info) at the registry, while Thick Whois stores full registration details (contact info) directly at the registry.

Why can't I get all Whois info from a Thin Whois lookup?

Because the registry only hosts technical pointers and status; the actual contact and administrative data is stored privately by the specific registrar, not the central registry.

More 312-50v12 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. qwerty100 👍 3 Answered A
    I think it's : A. Thin Whois model working correctly https://domaincocoon.com/thin-vs-thick-registry-whois
  2. insaniunt 👍 2 Answered A
    A. Thin Whois model working correctly Thin Whois - Stores only the name of the Whois server of the registrar of a domain, which in turn holds complete details on the data being looked up.
  3. duke_of_kamulu 👍 2
    pg 216 Thin Whois - Stores only the name of the Whois server of the registrar of a domain, which in turn holds complete details on the data being looked up.
  4. brrbrr 👍 2 Answered A
    - Thick WHOIS: information from all registrars for the specified set of data. - Thin WHOIS: limited information about the specified set of data.
  5. LordXander 👍 2 Answered A
    It is actually A because the limited information is part of thin WHOIS
Show 4 more comments
  1. prasoonmk 👍 1 Answered A
    What is a Thin WHOIS lookup? A thin WHOIS lookup provides limited technical data from the registry which would include identifying the sponsoring registrar, the status of the domain, along with the creation and expiration dates. The remaining data, that being the contact details, are stored directly at the holding registrar(OpenSRS). Examples of this would be .COM and .NET, which soon will be moving to thick WHOIS as per the articles above at ICANN. What is a Thick WHOIS lookup? A thick WHOIS lookup contains all the technical data with the registry, as such administrative and technical, owner contact details. In addition, the sponsoring registrar and registration status. With data handled directly at the registry level and not the registrar, there are limitations and restrictions to how the "domain lock" works, while making changes to contact details.
  2. medithaperera 👍 1
    I is A " unable to gather complete Whois information" means it is a Thin Whois model working correctly Mos
  3. qtygbapjpesdayazko 👍 1 Answered A
    Keyword "unable to gather complete Whois" Thin Whois model working correctly
  4. duke_of_kamulu 👍 1
    A is the Answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide