Whois

Yes. The whois command-line client is free and open source, and querying public WHOIS/RDAP servers costs nothing. Only large-scale commercial bulk APIs and historical WHOIS archives typically charge.

Yes. Querying publicly available registration data is legal in virtually all jurisdictions. What is regulated is how you use the results — harvesting personal contacts for spam or harassment violates GDPR, CAN-SPAM, and similar laws.

Sometimes. If the registrant did not enable privacy protection, WHOIS shows their name and contact details. Since GDPR, most personal registrations are redacted, so you often see a privacy proxy instead of the real owner.

RDAP (Registration Data Access Protocol) is the ICANN-mandated successor. It returns structured JSON over HTTPS and supports tiered access, but the classic whois protocol on port 43 is still widely supported.

Run 'whois example.com | grep -i expir' to extract the Registry Expiry Date field. For a quick visual check, use the Domain Age Checker tool.

WHOIS is a query-and-response protocol (RFC 3912) used to look up registration data for domain names and IP address blocks. A WHOIS lookup returns the registrar, registrant details (when public), creation and expiration dates, name servers, and domain status codes. It is a core passive reconnaissance and OSINT technique.

Install the client with 'sudo apt install whois', then run 'whois example.com' for a domain or 'whois 8.8.8.8' for an IP address. The client automatically selects the correct WHOIS server based on the TLD or IP region. Use -h to query a specific server directly.

Since the EU's GDPR took effect in 2018, most registrars redact personal registrant data or replace it with a privacy proxy service. This is legal and expected. The domain still functions; you simply see 'REDACTED FOR PRIVACY' instead of a name. Legitimate investigators can request data through RDAP tiered access or registrar abuse channels.

WHOIS returns unstructured free text over TCP port 43, while RDAP (Registration Data Access Protocol) returns standardized JSON over HTTPS with tiered access control. RDAP is the ICANN-mandated successor to WHOIS and is far easier to parse programmatically, though the legacy whois protocol remains widely available.

WHOIS queries a registrar/registry database and answers 'who registered this domain and when.' A DNS lookup queries authoritative name servers and answers 'where does this domain resolve right now.' They are complementary: WHOIS gives ownership and registration context, DNS gives live resolution data.

Run 'whois <ip>' and the client queries the appropriate Regional Internet Registry. For accuracy, target the correct RIR directly: 'whois -h whois.arin.net 8.8.8.8' for North America, whois.ripe.net for Europe, whois.apnic.net for Asia-Pacific, whois.lacnic.net for Latin America, and whois.afrinic.net for Africa. The response shows the org, netblock (CIDR), country, and abuse contact.

The five RIRs manage IP address allocation globally: ARIN (North America), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and Caribbean), and AFRINIC (Africa). IP WHOIS data lives in whichever RIR allocated the address, so querying the wrong one returns incomplete results.

Filter the output: 'whois example.com | grep -i expir'. Look for the 'Registry Expiry Date' field. Track this for your own domains to avoid accidental lapses, and note that expired domains enter a redemptionPeriod before becoming available again.

Status codes (EPP codes) describe a domain's operational state. clientTransferProhibited blocks registrar transfers, clientDeleteProhibited prevents deletion, redemptionPeriod means it expired and is in a grace window, pendingDelete means it is queued for removal, and serverHold/clientHold mean it has been suspended by the registry or registrar.

Use the -h flag: 'whois -h whois.verisign-grs.com example.com' queries Verisign directly for .com data. This helps when the default server returns thin or cached data, or when you need registry-authoritative records rather than a registrar's copy.

The whois client is not installed. Install it with 'sudo apt install whois' (Debian/Kali), 'sudo dnf install whois' (Fedora), 'sudo pacman -S whois' (Arch), or 'brew install whois' (macOS). Verify with 'whois --version'.

Registries throttle bulk queries from a single IP to prevent data harvesting. In batch loops, add delays (e.g., 'sleep 2' between lookups), spread queries over time, and for large-scale needs use official RDAP or bulk data APIs rather than scraping port 43.

Convert the Unicode name to its Punycode (xn--) form first, then query that. For example, a Cyrillic or accented domain must be encoded to ASCII with a tool like idn2 or a browser before 'whois xn--...' returns accurate data.

Yes. Registrant-supplied fields can be intentionally falsified, and privacy proxies hide the real owner. Never treat WHOIS ownership claims as proof on their own — corroborate with DNS, SSL certificate data, passive DNS, and other independent sources.

Check the creation date — domains registered within the last 30 days are a strong phishing signal. Combine a young registration date with privacy protection, suspicious name servers, and a brand-lookalike name to assess risk. The Domain Age Checker speeds this up.

Use a shell loop: 'for d in a.com b.com c.com; do whois $d; done'. To read from a file: 'while read d; do whois "$d"; sleep 2; done < domains.txt'. Add the sleep to avoid rate limits and redirect output to a file for reporting.

Redirect the output: 'whois example.com > whois_example.txt'. For timestamped, reproducible records in an investigation, use 'whois example.com | tee whois_$(date +%F).txt' so you both see and save the result.

Pipe through grep: 'whois example.com | grep -i registrar' for registrar info, or 'whois example.com | grep -iE "name server|nserver"' for authoritative name servers. Case-insensitive matching (-i) handles the inconsistent field casing across registries.

WHOIS is passive reconnaissance — it queries public registry databases, not the target's own systems, so it does not touch or alert the target. This makes it safe for the earliest stage of an authorized engagement, before any active scanning.

WHOIS comes first: it attributes a domain or IP to an owner and reveals name servers and netblocks. From there you move to DNS enumeration, subdomain discovery, HTTP probing, technology detection, and finally vulnerability scanning — each stage building on what WHOIS established.

An IP WHOIS returns the owning organization, the network range in CIDR notation, the country of allocation, the allocating RIR, and an abuse contact for reporting malicious activity. It attributes infrastructure but does not reveal open ports — use Nmap for that.

Some country-code registries (for example .de or certain others) restrict or heavily limit public WHOIS for privacy reasons, requiring web-based lookups, CAPTCHAs, or authenticated access. In those cases the port-43 client may return little or nothing, and you use the registry's official web interface instead.

Use reverse WHOIS services that index registrant fields, name servers, and registrant emails across the whole database. Because live WHOIS is redacted post-GDPR, historical WHOIS archives and passive DNS often work better for pivoting to related domains.

Verisign operates the authoritative registry WHOIS server whois.verisign-grs.com for .com and .net. The default whois client routes .com queries there automatically, but you can target it explicitly with 'whois -h whois.verisign-grs.com example.com'.

WHOIS uses TCP port 43, which some corporate proxies and VPNs block. If lookups time out, confirm outbound 43 is permitted, try a different network, or fall back to RDAP over HTTPS, which traverses standard web proxies far more reliably.

WHOIS tells you who registered a domain or owns an IP block. Shodan tells you what services and banners are exposed on hosts across the internet. WHOIS is for attribution; Shodan is for exposure and service discovery. They complement each other in reconnaissance.

Yes. Script whois around your targets, parse fields with grep/awk or a WHOIS-parsing library, and feed the registrar, dates, and name servers into your reporting. For structured, reliable automation at scale, prefer RDAP's JSON output over parsing free-text WHOIS.

redemptionPeriod means a domain has expired and entered a roughly 30-day grace window during which only the original registrant can restore it, usually for a fee. After that it moves to pendingDelete and then becomes available for new registration.

Mostly. Linux distributions use Marco d'Itri's full-featured client with consistent syntax. macOS ships an older BSD whois (install the Homebrew version for parity), and Windows uses Sysinternals whois or the Linux client under WSL. Core usage — 'whois <target>' and '-h <server>' — is the same everywhere.

Registration dates, registrar, and name servers are generally reliable because the registry maintains them. Registrant contact fields are less trustworthy — they may be privacy-protected, outdated, or deliberately falsified. Always corroborate ownership claims with independent evidence.

Yes. Monitoring new registrations of brand-lookalike domains across TLDs, checking their registration dates and name servers, and flagging privacy-protected or high-risk registrations lets brand teams detect cybersquatting and typosquatting early and pursue UDRP action.

Reverse WHOIS searches the WHOIS database by a field value — such as a registrant name, email, or organization — to return all domains sharing that value. It is a powerful pivot for mapping an entity's domain portfolio, though GDPR redaction limits it to historical or non-personal data.