Whois
Whois is a passive reconnaissance tool used to gather public registration data about domain names, IP addresses, and ASNs.
It queries public WHOIS databases to retrieve ownership, administrative contacts, creation/expiry dates, and registrar details — all without touching the target server directly.
Whois is essential in early recon phases for identifying ownership chains, domain infrastructure, and legal responsibility.
Common Options
Query Types
| Option |
Description
|
[DOMAIN] |
Lookup WHOIS data for a domain name
|
[IP] |
Retrieve WHOIS information for an IPv4/IPv6 address
|
[ASN] |
Query registration data for an Autonomous System Number
|
Server & Control
| Option |
Description
|
-h [HOST] |
Use a specific WHOIS server
|
-p [PORT] |
Connect to a custom port on the WHOIS server
|
--no-recursion |
Disable automatic follow‑up queries to referral servers
|
Output Handling
| Option |
Description
|
-B |
Suppress legal disclaimers
|
--verbose |
Print additional debugging and parsing information
|
--raw |
Output the unprocessed server response
|
Examples
Basic Domain Lookup
IP Address Lookup
Autonomous System Lookup
Query Specific WHOIS Server
whois -h whois.arin.net 8.8.8.8
Suppress Legal Info
Disable Referral Recursion
whois --no-recursion example.com
See Also