CEH Footprinting and Reconnaissance Practice Question
Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)
⚠ Common exam trap
EC-Council often tests the distinction between passive reconnaissance (which yields only public information) and active reconnaissance (which might reveal internal details), leading candidates to mistakenly assume that internal IPs or employee emails are obtainable from a public site report.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hosting provider and country
Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Internal IP addresses of the servers
Why it's wrong here
Netcraft, as an Open Source Intelligence (OSINT) tool, operates by gathering information from publicly accessible internet resources. It can identify public IP addresses associated with a domain through DNS lookups and network scanning. However, internal IP addresses, such as those defined by RFC 1918, are part of a private network infrastructure and are never directly exposed to the public internet, making them undiscoverable by external OSINT tools like Netcraft.
- ✓
Hosting provider and country
Why this is correct
Netcraft is highly effective at identifying a website's hosting provider and geographical location. It achieves this by performing comprehensive DNS queries, correlating IP address ranges with registered Autonomous System Numbers (ASNs), and cross-referencing this data with known internet service providers and their physical infrastructure locations. This capability provides critical intelligence regarding the operational footprint and jurisdictional context of a target.
- ✓
Site's first seen date and uptime history
Why this is correct
Netcraft maintains an extensive historical database of websites it has continuously monitored over many years. Through persistent scanning and archiving of website status and configuration changes, it can accurately report the exact date a site was first observed online. Furthermore, it tracks and aggregates uptime and downtime events, providing a detailed history of the site's operational reliability and availability over time.
- ✓
Web server software and version
Why this is correct
Netcraft actively employs various fingerprinting techniques to identify the web server software and its specific version running on a target domain. This involves analyzing HTTP response headers (e.g., the 'Server' header), examining error page signatures, and observing other unique characteristics of the server's behavior. This information is crucial for identifying potential vulnerabilities associated with known software versions.
- ✗
Employee email addresses
Why it's wrong here
While Netcraft is adept at gathering infrastructure and technology-related OSINT, it does not typically collect or display individual employee email addresses. Discovering employee email addresses usually requires different OSINT methodologies, such as searching public company directories, social media profiles, or utilizing specialized email enumeration tools, which fall outside the primary scope of Netcraft's infrastructure-focused scanning capabilities.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.