Footprinting & Reconnaissance · Module 02
WHOIS
Look up who owns a domain or IP, when it was registered, and its name servers.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
WHOIS is a query protocol and service used to retrieve registration information about domain names, IP address allocations, and related internet resources.
Identify domain registration details, registrar information, registration dates, and available ownership-related information.
Domain reconnaissance, threat intelligence, digital investigations, and authorized security assessments.
Key features
Retrieves available domain registration records.
Identifies the registrar responsible for a domain.
Shows available creation, update, and expiration dates.
Identifies the name servers associated with a domain.
Helps identify the organization or registry behind an IP allocation.
Shows limited data when privacy services or registry policies restrict disclosure.
Important commands
whois example.comRetrieve registration information for a domain.
whois 8.8.8.8Query registration information for an IP address.
whois -h <server> <domain>Query a specific WHOIS server.
whois -h whois.iana.org example.comSend the query to a named WHOIS server.
whois --helpShow available command-line options.
Practical examples
whois example.com
Purpose Retrieves available registration details for the domain.
whois 8.8.8.8
Purpose Retrieves IP registration / allocation info, often the responsible organization.
whois -h whois.iana.org example.com
Purpose Sends the query to that server; it may not hold the domain's detailed record.
Important points
- WHOIS vs DNS: WHOIS returns registration info; DNS resolves names to records like IP addresses.
- RDAP: The Registration Data Access Protocol is the modern alternative, with structured responses.
- Privacy protection: Registrant names, emails and phone numbers may be hidden or redacted.
- Data accuracy: Records can be incomplete, outdated, or limited by registry policy.
- Rate limits: WHOIS servers may limit how often you can query.
- Attribution limits: A registrar or IP record does not necessarily identify who operates a site.
Common use cases
Collect public registration information about a domain.
Investigate suspicious domains and compare registration details.
Gather registration info about domains seen in an incident.
Collect domain-related info during an authorized assessment.
Investigate potentially malicious domains and support research.
This tool is taught in Module 02
Read the full written notes, with diagrams, defense and detection.