Whois

Whois

Whois is a passive reconnaissance tool used to gather public registration data about domain names, IP addresses, and ASNs. It queries public WHOIS databases to retrieve ownership, administrative contacts, creation/expiry dates, and registrar details — all without touching the target server directly.

Whois is essential in early recon phases for identifying ownership chains, domain infrastructure, and legal responsibility.

Common Options

Query Types

Option	Description
[DOMAIN]	Lookup WHOIS data for a domain name
[IP]	Retrieve WHOIS information for an IPv4/IPv6 address
[ASN]	Query registration data for an Autonomous System Number

Server & Control

Option	Description
-h [HOST]	Use a specific WHOIS server
-p [PORT]	Connect to a custom port on the WHOIS server
--no-recursion	Disable automatic follow‑up queries to referral servers

Output Handling

Option	Description
-B	Suppress legal disclaimers
--verbose	Print additional debugging and parsing information
--raw	Output the unprocessed server response

Examples

Basic Domain Lookup

whois example.com

IP Address Lookup

whois 1.1.1.1

Autonomous System Lookup

whois AS13335

Query Specific WHOIS Server

whois -h whois.arin.net 8.8.8.8

Suppress Legal Info

whois -B example.com

Disable Referral Recursion

whois --no-recursion example.com

See Also

• dig
• nslookup
• theHarvester
• recon-ng
• Nmap