Thin vs Thick Whois Models in Footprinting
A certified ethical hacker is conducting a Whois footprinting activity on a specific domain. The individual is leveraging various tools such as Batch IP Converter and Whois Analyzer Pro to retrieve vital details but is unable to gather complete Whois information from the registrar for a particular set of data. As the hacker, what might be the probable data model being utilized by the domain's registrar for storing and looking up Whois information?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept tested is the operational difference between Thin and Thick Whois models; the common trap is assuming incomplete data indicates a system failure rather than a designed architectural feature of the Thin model.
This question explores the distinction between Thin and Thick Whois models during ethical hacking reconnaissance. It establishes that a Thin Whois model intentionally provides limited data, which explains why a hacker cannot retrieve complete registrar details directly from the registry.
Candidates often select 'malfunctioning server' options because they interpret the lack of detailed information as an error or outage, failing to recognize that limited data is the standard behavior for a functioning Thin Whois system.
Community Discussion (9 comments)
- Thick WHOIS: information from all registrars for the specified set of data. - Thin WHOIS: limited information about the specified set of data.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A Thin Whois model stores only minimal technical data at the registry level (such as the sponsoring registrar and domain status), while the complete contact and administrative details are held by the individual registrars. Therefore, when a hacker queries a Thin Whois server, it is working correctly by design to provide only this limited subset of information. The inability to gather complete data is not a failure but the expected outcome of interacting with a Thin Whois infrastructure.Why the Other Options Are Wrong
Options B and C suggest a malfunctioning server, but there is no evidence of downtime or errors in the scenario; the limitation is structural, not technical. Option D describes a Thick Whois model, where the registry itself stores the full set of registration details. If the model were Thick and working correctly, the hacker would have been able to gather the complete information immediately without needing to query the registrar separately.Community Comment Notes
Community consensus strongly favors Option A. As user LordXander noted, "It is actually A because the limited information is part of thin WHOIS." Another commenter emphasized that Thin Whois "Stores only the name of the Whois server... which in turn holds complete details," confirming that the missing data resides elsewhere, not due to a bug.Exam Strategy
When analyzing footprinting tools and protocols, always distinguish between intentional data limitations (like privacy laws or model architecture) and technical failures. If a tool returns partial data consistently, consider if the underlying system (e.g., Thin Whois) is designed that way before suspecting a malfunction.
Frequently Asked Questions
What is the difference between Thin and Thick Whois?
Thin Whois stores minimal data (registrar info) at the registry, while Thick Whois stores full registration details (contact info) directly at the registry.
Why can't I get all Whois info from a Thin Whois lookup?
Because the registry only hosts technical pointers and status; the actual contact and administrative data is stored privately by the specific registrar, not the central registry.