whois

whois turns a bare domain or IP into registration context: the registrar, creation and expiry dates, name servers, and which organization an IP block is allocated to. It is the quietest recon step you have, since most lookups read public registry data over TCP/43 without touching the target at all, so it is what you run first on a CTF domain, a homelab DNS name, or an in-scope IP before you make any noise.

Mental model: whois QUERY, where QUERY is a domain, an IP, or a CIDR block. The client picks the right registry for you.

New to WHOIS? Core concepts

Registry vs registrar: the registry operates the TLD; the registrar sold the domain. Thin registries (.com) hold a stub that points at the registrar’s thick record where the real contacts live
Referral chain: the client asks IANA’s root first, then follows each server’s referral to the TLD registry that actually holds the record
RIR: the five Regional Internet Registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC) answer IP and netblock lookups, not domains
Port 43 vs RDAP: classic whois is free-form text over TCP/43; RDAP is the modern JSON-over-HTTPS successor with stable field names
Registration timeline: Creation Date / Updated Date / Registry Expiry Date reveal a domain’s age, freshness, and lapse risk
Name servers: Name Server lines are the authoritative NS hostnames, ready to feed into dig
Netblock / CIDR: an IP query returns the owning org and its allocated range (10.0.0.0/8), usually the hosting provider rather than the site owner
REDACTED FOR PRIVACY: privacy rules blanked the contact fields; expected, so pivot to dates, NS, and DNS

When to reach for whois (and when not)

Reach for it as the quiet first recon step: who registered a domain and when it was created or expires, which name servers it delegates to, and which org owns an in-scope IP block plus its abuse contact, all read from public registry data over TCP/43 without touching the target.

Reach for something else when you need the actual DNS records (A/MX/TXT), that is dig / nslookup; to scan the IP whois identified for live services, use nmap; to widen the OSINT picture around the target, theHarvester; and for structured, machine-readable fields at scale, reach for RDAP (JSON over HTTPS) instead of the port-43 text.

Install, update, verify#

sudo apt update && sudo apt install -y whois        # Debian / Ubuntu / Kali
sudo dnf install -y whois                           # Fedora / RHEL
brew install whois                                  # macOS (newer than the built-in)
sudo apt install --only-upgrade -y whois            # update

whois --version       # client version + build
command -v whois      # confirm it is on PATH

Keeping it current matters more than it looks: the package carries a built-in map of which server answers for each TLD and IP block, so updates keep new gTLDs and reassigned ranges routing correctly. On Windows use Sysinternals whois.exe or whois inside WSL.

Flags you’ll actually use#

Skim these first; the cheat sheet below is these flags combined.

Flag	Does	Flag	Does
(none)	Auto-route to the right server	`-r`	RIPE: no recursive contact lookups
`-h HOST`	Query a specific server	`-B`	RIPE: unfiltered (show contact objects)
`-p PORT`	Connect to a non-default port	`-a`	RIPE: search all mirrored sources
`-H`	Hide the legal disclaimer	`-b`	RIPE: brief netblock + abuse contact
`--verbose`	Show which servers get contacted	`-T TYPE`	RIPE: restrict the object type
`-i ATTR`	RIPE: inverse lookup by attribute	`-m` / `-M`	RIPE: one-level / all more-specific blocks
`-x`	RIPE: exact-match object only	`--version`	Client version and build

Flag support varies by client and by the registry you reach. Plain whois DOMAIN covers most needs; -r / -B / -a / -m / -i are RIPE-style and may be ignored by registries that do not implement them.

Cheat sheet#

Where a block builds up, each line adds one flag, so you can stop at the line that does the job.

# Pick the query type
whois DOMAIN                                   # domain registration context
whois TARGET_IP                                # IP allocation + owning org
whois TARGET_RANGE                             # netblock for a whole CIDR range

# Build up a domain lookup: stop at the line you need
whois DOMAIN                                   # 1. the full record
whois -H DOMAIN                                # 2. + drop the legal disclaimer footer
whois -H --verbose DOMAIN                      # 3. + name the server that answered
whois -h whois.verisign-grs.com DOMAIN         # 4. or pin one registry server by hand

# Find the right server for an odd TLD
whois -h whois.iana.org example.dev            # ask IANA which registry answers the TLD
whois -h whois.nic.google example.dev          # then query that registry directly

# Extract fields (grep the free-form text)
whois DOMAIN | grep -i "name server"                    # name servers only
whois DOMAIN | grep -iE "creation|expir|updated"        # registration timeline
whois DOMAIN | grep -i "registrar:"                     # managing registrar
whois DOMAIN | grep -iE "domain status|status:"         # registrar lock / EPP status
whois TARGET_IP | grep -iE "orgname|netname|cidr"       # owner + allocated range
whois TARGET_IP | grep -i "abuse"                       # abuse contact for the block

# IP / netblock (RIR tuning, RIPE / APNIC style)
whois -r TARGET_IP                             # skip recursive contact objects (less noise)
whois -b TARGET_IP                             # brief range + abuse contact only
whois -B TARGET_IP                             # unfiltered: show the hidden contact objects
whois -m TARGET_RANGE                          # one level of more-specific sub-allocations
whois -i origin AS64500                        # inverse lookup: routes originated by an ASN

# Structured (JSON, modern)
curl -s https://rdap.org/domain/DOMAIN | jq .                                   # RDAP, not port 43
curl -s https://rdap.org/ip/TARGET_IP | jq '.name, .startAddress, .endAddress'  # IP block, structured

# Save + echo for notes
whois -H DOMAIN | tee lookups/whois-$(date +%Y%m%d-%H%M).txt

Command breakdowns#

Each block below explains one situation, the exact command, and what to expect back.

Look up a domain’s registration#

whois DOMAIN

Registrar, creation/expiry dates, name servers, and status codes. The client follows the referral chain to the registry that actually holds the record.

Find who owns an IP address#

whois TARGET_IP

Answered by the relevant RIR (ARIN, RIPE, APNIC, LACNIC, AFRINIC). Shows the owning org, allocated netblock, and abuse contact, usually the hosting provider, not whoever runs the site.

Map a whole network block (CIDR)#

whois TARGET_RANGE

Returns the parent allocation for the range (10.0.0.0/8-style CIDR) instead of a single host, so you can see how large a block one org controls.

Check when a domain expires#

whois DOMAIN | grep -iE "creation|expir|updated"

The registration timeline at a glance: catch a lapse on your own domains, or flag a suspiciously fresh creation date on a target.

Pull just the name servers#

whois DOMAIN | grep -i "name server"

The NS hostnames, ready to feed into a dig pass or an in-scope zone-transfer attempt.

Find the abuse contact for an IP#

whois -b TARGET_IP

-b returns a brief netblock plus its abuse mailbox and skips the rest of the record. If your client lacks -b, whois TARGET_IP | grep -i abuse gets the same address.

Query one registry server directly#

whois -h whois.verisign-grs.com DOMAIN

-h asks one server by hand when the auto-route returns noise, or when you want the thin registry (.com / .net) stub specifically rather than the registrar’s record.

Find the right whois server for an unfamiliar TLD#

whois -h whois.iana.org example.dev

IANA’s root whois names the registry that answers for that TLD; query that server next. Fixes most No match results on valid new-gTLD domains.

Strip the legal disclaimer for clean notes#

whois -H DOMAIN

The same record without the long boilerplate footer registries append. Far nicer to paste into notes.

Cut the noise on a RIPE / APNIC IP lookup#

whois -r TARGET_IP

-r disables recursive contact-object expansion, so you get the route and netblock without every linked person/role object trailing behind it.

See which server actually answered#

whois --verbose DOMAIN

Prints a Using server whois.verisign-grs.com.-style line before the record, naming the registry that responded. How you confirm the route and debug a bad referral.

Enumerate more-specific sub-allocations#

whois -m TARGET_RANGE      # one level down
whois -M TARGET_RANGE      # every level down

On a RIPE / APNIC inetnum, -m lists one level of more-specific child ranges and -M lists all of them, showing how a large allocation is carved up internally.

Find every route an ASN originates#

whois -i origin AS64500

An inverse lookup: instead of matching an object’s key, it matches the origin: attribute and returns every route object announced by that AS. Maps the prefixes behind an autonomous system.

Get structured JSON instead of free-form text#

curl -s https://rdap.org/domain/DOMAIN | jq '.events, .nameservers'
curl -s https://rdap.org/ip/TARGET_IP | jq '.name, .startAddress, .endAddress'

RDAP is the modern, machine-readable successor over HTTPS. Reach for it when you are parsing at scale or port 43 is blocked.

Save a timestamped record to your notes#

whois -H DOMAIN | tee lookups/whois-$(date +%Y%m%d-%H%M).txt

Registration data drifts, so capture the raw record once and grep the file afterward instead of re-hitting the registry.

Reading the output#

Field	Means	Use it for
`Registrar` / `Registry`	Where the domain is managed / the TLD operator	Infrastructure clue, not the site owner
`Creation` / `Updated` / `Registry Expiry Date`	Registration timeline	Freshness, lapse risk
`Name Server`	Authoritative NS hostnames	Feed straight into DNS tooling
`Domain Status` (e.g. `clientTransferProhibited`)	Registrar lock state	Normal, not a vulnerability
`REDACTED FOR PRIVACY`	Privacy rules hid the field	Expected; pivot, do not stop
`OrgName` / `NetName` / `CIDR` (IP)	Owning org + allocated block	Identify the provider
`OrgAbuse` / `abuse-c`	Abuse reporting contact	Who to notify about the block

Troubleshooting#

Problem	Cause	Fix
`command not found`	Not installed / stale PATH	Reinstall; open a fresh shell
Lookup hangs or times out	TCP/43 blocked by a firewall	Switch to RDAP over HTTPS, or a different network
`No match for DOMAIN`	Wrong server or unregistered	`whois -h whois.iana.org DOMAIN` to find the registry
Mostly `REDACTED FOR PRIVACY`	Privacy rules / WHOIS privacy	Expected; pivot to name servers, dates, DNS
`Query rate exceeded`	Too many rapid lookups	Slow down, add delays, or switch to RDAP
Output hard to parse	Free-form text differs per registry	Grep specific fields, or use RDAP JSON
Wrong RIR data for an IP	Block transferred between RIRs	Re-query and follow the referral the record names

Gotchas#

whois is registration data, not DNS. It will not return A/MX/TXT records; that is dig’s job.
RDAP field names do not match the port-43 text. RDAP returns structured JSON (events, nameservers, startAddress), so grep patterns written for the free-form output will not carry over; you parse the two by different keys.
Thin registries hand you a stub, not the contacts. TLDs like .com run a thin model where the registry record only points at the registrar; follow the referral to the registrar’s thick record for the full contact and status fields.
The registry and the registrar can disagree on dates. The thin .com stub shows the registry’s timeline while the registrar’s thick record may carry a different Updated Date; trust the registry for expiry and the registrar for contact changes.
Rate limits are per-source-IP and mostly silent. A burst of port-43 lookups starts returning Query rate exceeded or quietly truncated records; space them out or switch to RDAP.

Pairs with#

dig and nslookup resolve the domain and pull the DNS records once whois hands you the name servers. nmap scans the IP that whois identifies for live services, and theHarvester widens the OSINT picture around the same target. For structured, stable fields and automation reach for RDAP (JSON over HTTPS) instead of the port-43 text; for registration changes over time, a hosted WHOIS-history service goes deeper than any single live lookup.