By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Passive Reconnaissance: WHOIS

WHOIS is a query and response protocol used to look up information about domain names, IP addresses, and autonomous systems. As a passive reconnaissance tool, WHOIS provides valuable information about target organizations without directly interacting with their systems. This makes it an essential first step in the information gathering phase of penetration testing.

What You'll Learn

  • What WHOIS is and how it works
  • Information available through WHOIS lookups
  • WHOIS privacy and protection services
  • Using WHOIS for penetration testing
  • WHOIS command-line tools and web services
  • WHOIS for IP addresses (ARIN, RIPE, APNIC)
  • Legal and ethical considerations
  • Combining WHOIS with other OSINT techniques

What Is WHOIS?

WHOIS is a protocol for querying databases that store registered users or assignees of internet resources such as domain names and IP addresses.

The Purpose:

Domain Registration System:
1. You register example.com
2. Information stored in registry database
3. Anyone can query: "Who owns example.com?"
4. WHOIS returns registration details

Purpose:
- Transparency
- Contact information for domain issues
- Verify ownership
- Investigate abuse

What Information Does WHOIS Provide?

Domain WHOIS Data:

Typical Information:
✓ Domain name
✓ Registrar (where domain was purchased)
✓ Registration date
✓ Expiration date
✓ Name servers
✓ Registrant name/organization
✓ Registrant email
✓ Registrant phone number
✓ Registrant address
✓ Administrative contact
✓ Technical contact
✓ Domain status codes

Example Output:

Domain Name: example.com
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iana.org
Registrar URL: http://res-dom.iana.org
Updated Date: 2023-08-14T07:01:31Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2024-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority

Registrant Name: Internet Assigned Numbers Authority
Registrant Organization: Internet Assigned Numbers Authority
Registrant Street: 12025 Waterfront Drive, Suite 300
Registrant City: Los Angeles
Registrant State/Province: CA
Registrant Postal Code: 90094
Registrant Country: US
Registrant Phone: +1.3103230788
Registrant Email: [email protected]

Admin Name: Internet Assigned Numbers Authority
Tech Name: Internet Assigned Numbers Authority

Name Server: a.iana-servers.net
Name Server: b.iana-servers.net

DNSSEC: signedDelegation

WHOIS for Domains

Using Command-Line WHOIS:

Linux/macOS:

# Basic query
whois example.com

# Query specific WHOIS server
whois -h whois.verisign-grs.com example.com

# Thin WHOIS (less detail)
whois example.com | grep -E "(Registrar|Name Server|Creation Date)"

Windows (requires installation):

# Install whois (Sysinternals)
# Download from Microsoft

# Or use PowerShell alternative
Resolve-DnsName example.com -Type NS

Web-Based WHOIS:

Popular WHOIS lookup sites:
- whois.domaintools.com
- who.is
- whois.icann.org
- lookup.icann.org

Key Fields to Note:

1. Registrar:

Who sold the domain?
Examples: GoDaddy, Namecheap, Cloudflare

2. Registration Dates:

Creation Date: When domain was first registered
Updated Date: Last modification
Expiry Date: When domain expires

Use case:
- Old domain = established organization
- New domain = possibly suspicious
- Expiring soon = potential takeover opportunity

3. Name Servers:

Where DNS is hosted
Examples:
- ns1.cloudflare.com (Cloudflare)
- ns-XXX.awsdns-XX.com (AWS Route 53)
- ns1.google.com (Google Cloud DNS)

Reveals hosting/CDN provider

4. Registrant Information:

Name, organization, email, phone, address
May be hidden by privacy protection

5. Domain Status:

clientTransferProhibited: Can't transfer
clientUpdateProhibited: Can't modify
serverHold: Domain suspended
redemptionPeriod: Being deleted

WHOIS Privacy Protection

Many registrars offer privacy protection to hide personal information.

Without Privacy Protection:

Registrant Name: John Doe
Registrant Email: [email protected]
Registrant Phone: +1.5551234567
Registrant Address: 123 Main St, Anytown, CA 90210

With Privacy Protection:

Registrant Name: Privacy Protection Service
Registrant Organization: Domains By Proxy, LLC
Registrant Email: [email protected]
Registrant Phone: +1.4806242599
Registrant Address: Privacy Service, Scottsdale, AZ

Bypassing Privacy:

Historical WHOIS:
- Domain may not always have had privacy
- Check historical records
- Services: SecurityTrails, DomainTools (paid)

Related Domains:
- Check other domains by same owner
- May not all have privacy enabled

Subdomain Enumeration:
- Often reveals organizational structure
- May find contact emails

WHOIS for IP Addresses

Regional Internet Registries (RIRs):

ARIN:   American Registry for Internet Numbers
        North America
        whois.arin.net

RIPE:   Réseaux IP Européens
        Europe, Middle East, Central Asia
        whois.ripe.net

APNIC:  Asia-Pacific Network Information Centre
        Asia-Pacific
        whois.apnic.net

LACNIC: Latin America and Caribbean Network Information Centre
        whois.lacnic.net

AFRINIC: African Network Information Centre
         whois.afrinic.net

IP WHOIS Query:

# Automatic RIR detection
whois 8.8.8.8

# Specific RIR
whois -h whois.arin.net 8.8.8.8

IP WHOIS Information:

NetRange:       8.0.0.0 - 8.255.255.255
CIDR:           8.0.0.0/8
NetName:        LVLT-ORG-8-8
NetHandle:      NET-8-0-0-0-1
Parent:         ()
NetType:        Direct Allocation
OriginAS:
Organization:   Google LLC (GOGL)
RegDate:        1992-12-01
Updated:        2014-03-14

OrgName:        Google LLC
OrgId:          GOGL
Address:        1600 Amphitheatre Parkway
City:           Mountain View
StateProv:      CA
PostalCode:     94043
Country:        US
OrgTechHandle: ZG39-ARIN
OrgTechName:   Google LLC
OrgTechPhone:  +1-650-253-0000

What You Can Learn:

✓ Organization owning the IP block
✓ IP range (CIDR notation)
✓ Allocation date
✓ Contact information
✓ ASN (Autonomous System Number)
✓ Abuse contacts

Autonomous System Numbers (ASN)

ASN identifies a collection of IP networks under single administrative control.

ASN WHOIS:

# Query ASN
whois AS15169

# Output:
aut-num:        AS15169
as-name:        GOOGLE
descr:          Google LLC
country:        US

Finding ASN from IP:

# Using whois
whois -h whois.cymru.com " -v 8.8.8.8"

# Output shows ASN

Why ASNs Matter:

1. Identify all IP ranges owned by organization
2. Find infrastructure (hosting, CDN, etc.)
3. Map network architecture
4. Discover related organizations

WHOIS in Penetration Testing

Phase 1: Initial Information Gathering

# Target: example.com

# Step 1: Domain WHOIS
whois example.com

# Collect:
# - Registrant name/org
# - Email addresses
# - Phone numbers
# - Name servers
# - Registration dates

# Step 2: IP WHOIS
# First resolve domain to IP
host example.com
# Output: example.com has address 93.184.216.34

whois 93.184.216.34

# Collect:
# - Hosting provider
# - IP range (CIDR)
# - ASN
# - Organization details

# Find related domains
# Search registrant email
whois -h whois.verisign-grs.com "[email protected]"

# Find domains on same name servers
# (Use tools like SecurityTrails)

# Find all IPs in same range
# If target is 93.184.216.34/24
# Scan entire 93.184.216.0/24
nmap 93.184.216.0/24

Phase 3: Historical Analysis

# Check historical WHOIS (web services)
# - DomainTools (paid)
# - SecurityTrails (paid/free tier)
# - WhoisXML API

# Look for:
# - Previous owners
# - Old contact info (before privacy)
# - Infrastructure changes

Advanced WHOIS Techniques

1. Reverse WHOIS

Search for all domains owned by specific person/organization.

Tools:
- ViewDNS.info (reverse whois)
- WhoisXML API
- DomainTools Reverse WHOIS

Example:
Search: "John Doe" or "[email protected]"
Results: All domains registered to that entity

2. WHOIS API Integration

#!/usr/bin/env python3
import whois

# Query domain
domain_info = whois.whois('example.com')

print(f"Domain: {domain_info.domain_name}")
print(f"Registrar: {domain_info.registrar}")
print(f"Creation Date: {domain_info.creation_date}")
print(f"Expiration Date: {domain_info.expiration_date}")
print(f"Name Servers: {domain_info.name_servers}")
print(f"Emails: {domain_info.emails}")

3. Bulk WHOIS Queries

# Query multiple domains
cat domains.txt
# example.com
# example.org
# example.net

# Bulk query
while read domain; do
  echo "=== $domain ==="
  whois $domain | grep -E "(Registrar|Creation Date|Expiry)"
  echo
done < domains.txt

4. Monitoring WHOIS Changes

# Track WHOIS for changes
# Useful for:
# - Domain expiry monitoring
# - Ownership changes
# - Infrastructure changes

# Tools:
# - DomainTools Monitor
# - WhoisXML API monitoring
# - Custom scripts with cron

WHOIS Data Sources

gTLD Registries:

.com/.net:  Verisign (whois.verisign-grs.com)
.org:       Public Interest Registry
.info:      Afilias
.biz:       Neustar

ccTLD Registries:

.uk:  Nominet (whois.nic.uk)
.de:  DENIC (whois.denic.de)
.fr:  AFNIC (whois.nic.fr)
.jp:  JPRS (whois.jprs.jp)
.cn:  CNNIC (whois.cnnic.cn)

Try It Yourself

Exercise 1: Basic Domain WHOIS

# Pick a domain you own or a well-known domain
whois google.com

# Identify:
# 1. Registrar
# 2. Name servers (DNS provider)
# 3. Registration date (how old?)
# 4. Expiration date
# 5. Any contacts visible?

Exercise 2: IP WHOIS

# Find IP of a website
nslookup google.com
# Or
host google.com

# Query IP WHOIS
whois 142.250.185.46

# Identify:
# 1. Organization
# 2. IP range (CIDR)
# 3. ASN
# 4. Country

Exercise 3: Compare Privacy

# Find a domain with privacy protection
whois example-with-privacy.com

# Find a domain without privacy
# (Maybe an older, less privacy-conscious site)

# Compare what information is visible

Exercise 4: ASN Investigation

# Google's ASN
whois AS15169

# Amazon's ASN
whois AS16509

# See what organizations control large networks

WHOIS Tools

Command-Line:

# whois (standard)
whois domain.com

# jwhois (improved)
sudo apt install jwhois

# whois (Windows - Sysinternals)
whois.exe domain.com

Web-Based:

- who.is
- whois.domaintools.com
- lookup.icann.org
- viewdns.info
- mxtoolbox.com/whois.aspx

Programmatic:

# Python
pip install python-whois
import whois

# Ruby
gem install whois
require 'whois'

# Node.js
npm install whois-json

✓ Looking up your own domains
✓ Verifying domain ownership
✓ Investigating abuse/spam
✓ Security research (authorized)
✓ Due diligence (business)

Ethical Guidelines:

1. WHOIS data is public, but respect privacy
2. Don't harvest for spam/harassment
3. Use for legitimate purposes only
4. In pentesting: Get written authorization
5. Don't DoS WHOIS servers (rate limit queries)

GDPR Impact:

Since 2018, GDPR affects WHOIS:
- Less personal data visible for EU domains
- "Redacted for Privacy" common
- Legitimate interest access process
- Historical data still valuable

Combining WHOIS with Other OSINT

Workflow:

1. WHOIS domain.com
   → Get emails, name servers, dates

2. Google email addresses
   → Find other domains, social media

3. Check name servers
   → Identify hosting provider

4. WHOIS IP address
   → Find IP range, organization

5. Search registrant name
   → Find related entities

6. Historical WHOIS
   → Previous configurations

Quick Reference

# Domain WHOIS
whois example.com

# IP WHOIS
whois 8.8.8.8

# ASN WHOIS
whois AS15169

# Specific WHOIS server
whois -h whois.verisign-grs.com example.com

# Filter output
whois example.com | grep -i "registrar\|name server\|creation date"

# Save output
whois example.com > whois_output.txt

Common WHOIS Status Codes

clientTransferProhibited:  Transfer locked
clientUpdateProhibited:    Updates locked
clientDeleteProhibited:    Deletion locked
serverHold:                Domain suspended
redemptionPeriod:          Grace period before deletion
pendingDelete:             Being deleted
addPeriod:                 Recently registered
autoRenewPeriod:           Auto-renewal active

Resources

Tools:

  • whois: Command-line tool (built into Linux/macOS)
  • ViewDNS.info: Free WHOIS tools including reverse WHOIS
  • SecurityTrails: Historical WHOIS data
  • DomainTools: Comprehensive WHOIS research (paid)

APIs:

  • WhoisXML API: Programmatic WHOIS access
  • ipwhois: Python library for IP WHOIS
  • python-whois: Domain WHOIS for Python

Reading:

Practice:

  • Look up your own domains
  • Compare WHOIS data across registrars
  • Build a WHOIS monitoring script
  • Integrate WHOIS into recon automation

Next Steps

  1. Master basic WHOIS queries for domains and IPs
  2. Explore historical WHOIS services
  3. Learn reverse WHOIS techniques
  4. Automate WHOIS in reconnaissance scripts
  5. Combine with DNS enumeration (next lesson!)

WHOIS is the foundation of passive reconnaissance. It's legal, it's passive, and it reveals surprising amounts of information about your targets!

"WHOIS: The internet's phone book, revealing more than you'd expect."

Up next

Passive Recon - crt.sh

Certificate transparency log searches.