IntermediateOSINT

WHOIS Lookup Guide: Domain Registration Intelligence

Learn how to use WHOIS lookups for domain registration intelligence, including querying registrar data, analyzing historical records, and privacy protection.

#WHOIS#OSINT#Domain Reconnaissance#Information Gathering#DNS

Domain Registration Intelligence

WHOIS is a protocol and methodology for extracting intelligence from domain registration records. Every registered domain leaves a data trail — ownership details, registration dates, name servers, and registrar information — that investigators can query to map an organization's digital footprint, identify infrastructure relationships, and uncover hidden connections between online assets.

Prerequisites

Before studying WHOIS, you should understand:

**OSINT Introduction** — Information gathering methodology

**DNS Enumeration** — How domains and DNS work

**Networking Basics** — IP addressing, protocols

**Linux Commands Explained** — Command line usage, grep, awk

WHOIS Data Fields

**Domain Name** — The queried domain

**Registrar** — The company where registered

**Registration Date** — When first registered

**Expiration Date** — When registration expires

**Name Servers** — DNS servers for the domain

**Registrant Contact** — Owner's name, organization, address

**Domain Status** — Status codes (clientTransferProhibited, etc.)

Using WHOIS from the Command Line

Basic Queries

# Basic query
whois example.com

# Query specific WHOIS server
whois -h whois.verisign-grs.com example.com

# Query by IP address
whois 8.8.8.8

# Extract creation and expiration dates
whois example.com | grep -E "Creation Date|Expiration Date"

Analyzing Results

# Extract name servers
whois example.com | grep -i "name server" | awk '{print $NF}'

# Check domain status codes
whois example.com | grep -i "domain status"

# Extract registrant organization
whois example.com | grep -i "registrant organization" | head -1

WHOIS Analysis Script

#!/bin/bash
DOMAIN=$1

echo "=== WHOIS Analysis for $DOMAIN ==="
whois "$DOMAIN" | grep -E "Creation Date|Expiration Date|Updated Date"
whois "$DOMAIN" | grep -i "registrar:" | head -3
whois "$DOMAIN" | grep -i "name server" | awk '{print $NF}'

Advanced WHOIS Techniques

Historical WHOIS Data

Compare current data with historical records to identify changes indicating ownership transfer:

# Use online services for historical WHOIS
# whois-history.com, domaintools.com, whoisfreaks.com

Reverse WHOIS Lookup

Find all domains registered by the same person or organization.

IP WHOIS

# Network ownership information
whois 8.8.8.8 | grep -i "inetnum|CIDR|netrange"
whois 8.8.8.8 | grep -i "org-name|organization"

ASN Lookup

# Find ASN for an IP
whois -h whois.cymru.com " -v 8.8.8.8"

# Find IP ranges for an ASN
whois -h whois.radb.net -- "-i origin AS15169" | grep -E "^route:"

GDPR Impact

Since GDPR enforcement in 2018, WHOIS data has become less revealing. Many registrars offer privacy protection by default:

whois privatized-domain.com
# Shows: REDACTED FOR PRIVACY

Working with Redacted Data

# Registrar identification
whois target.com | grep "Registrar:"

# Name server analysis
whois target.com | grep "Name Server:"

# Domain age calculation
creation=$(whois target.com | grep "Creation Date" | head -1 | awk '{print $NF}')
echo "Domain age: $(( ($(date +%s) - $(date -d "$creation" +%s)) / 86400 / 365 )) years"

Real-World Use Cases

Phishing Detection via Domain Age

SUSPICIOUS_DOMAIN="secure-login-bank-verify.com"
CREATION_DATE=$(whois "$SUSPICIOUS_DOMAIN" | grep "Creation Date" | awk '{print $NF}')
DAYS_OLD=$(( ($(date +%s) - $(date -d "$CREATION_DATE" +%s)) / 86400 ))
echo "Domain is $DAYS_OLD days old"

Malicious Infrastructure Investigation

MALICIOUS_DOMAINS=("evil1.com" "evil2.com" "evil3.com")
for domain in "${MALICIOUS_DOMAINS[@]}"; do
    echo "$domain: $(whois "$domain" | grep -E "Registrar|Name Server" | head -2)"
done

Common Mistakes

Relying solely on WHOIS: Privacy protection and false registration data mean WHOIS should not be the only source.

Ignoring rate limits: WHOIS servers enforce rate limits. Add delays between queries.

Not checking multiple servers: Different TLDs use different WHOIS servers.

Best Practices

**Cross-reference WHOIS data** — Compare with DNS, web, and social media intelligence

**Use historical WHOIS** — Past records may reveal ownership

**Respect rate limits** — Add delays between queries

**Check multiple TLDs** — Same organization may own different TLDs

**Understand privacy laws** — GDPR and CCPA have reduced data availability

Related Tools

**whois** — Standard UNIX WHOIS client

**Domaintools** — Professional WHOIS research

**dnsrecon** — DNS and WHOIS reconnaissance

**theHarvester** — Email and domain intelligence

OSINT Introduction

DNS Enumeration

Subdomain Enumeration

Reconnaissance Workflow

Summary

WHOIS lookups provide domain registration intelligence including ownership, registration dates, and name servers. GDPR has reduced personal data availability, but valuable information like registrar, domain age, and name server infrastructure remains accessible.

Knowledge Check

What WHOIS fields remain available with privacy protection?

How does GDPR affect WHOIS data availability?

What is a reverse WHOIS lookup and when would you use it?

How can domain age help identify malicious domains?

What information can ASN lookups provide beyond standard WHOIS?

Frequently Asked Questions

What information does a WHOIS lookup provide?

WHOIS reveals domain registrar, registration and expiration dates, name servers, registrant contact details (if not privacy-protected), and domain status codes. This information helps map an organization's infrastructure.

How has GDPR affected WHOIS data availability?

Since GDPR enforcement in 2018, registrars redact personal information like names, emails, and phone numbers. You can still access registrar name, name servers, registration dates, and domain status, but ownership details are often hidden.

What is a reverse WHOIS lookup?

A reverse WHOIS lookup finds all domains registered by the same person or organization. This reveals the full scope of an organization's web presence. Tools like DomainTools and SecurityTrails offer reverse WHOIS search capabilities.

How can domain age help detect phishing sites?

Phishing domains are typically very new — often days or weeks old. A WHOIS lookup showing a domain registered recently is a strong indicator of malicious intent. Legitimate organizations usually have domains aged years or decades.

What is an ASN lookup and why is it useful?

ASN (Autonomous System Number) lookups identify the network operator managing an IP range. This reveals which hosting provider or ISP controls infrastructure, helping map an organization's network footprint beyond individual domains.

Why should you query multiple WHOIS servers?

Different TLDs (.com, .org, .uk, etc.) use different WHOIS servers. A single query may miss information available through the authoritative server. Querying the TLD-specific server ensures complete data retrieval.

What are domain status codes?

Status codes like clientTransferProhibited indicate domain restrictions. clientTransferProhibited prevents unauthorized transfers, while serverDeleteProhibited prevents deletion. These codes reveal the domain's protection level and registrar lock status.

How do you perform an IP WHOIS lookup?

IP WHOIS queries reveal network ownership, CIDR ranges, and organization names. Use `whois 8.8.8.8` to see Google's IP range. This helps identify hosting providers and map network infrastructure during reconnaissance.

What tools complement WHOIS for OSINT?

Combine WHOIS with [DNS Enumeration](/learn/dns-enumeration) for infrastructure mapping, [Google Dorking](/learn/google-dorking-guide) for indexed information, and [Subdomain Enumeration](/learn/subdomain-enumeration) for attack surface discovery.

Why is WHOIS rate limiting important?

WHOIS servers enforce rate limits to prevent abuse. Exceeding limits can result in temporary IP bans. Add delays (2-5 seconds) between queries and cache results to avoid hitting rate limits during automated recon.