How to use the command 'whois' (with examples)

The ‘whois’ command-line client is used for retrieving information about domain names and IP addresses by querying WHOIS servers. By providing a domain name or IP address as an argument, the command sends a request to the WHOIS server and retrieves the registered information associated with the domain or IP address.

Use case 1: Get information about a domain name

whois example.com

Motivation: If you want to gather detailed information about a specific domain name, such as the domain registrar, registration date, expiration date, and nameservers, you can use the ‘whois’ command. This can be useful for conducting research, checking the ownership of a domain, or troubleshooting domain-related issues.

‘whois’ is the command-line client for the WHOIS protocol.
’example.com’ is the domain name for which you want to retrieve information.

Domain Name: EXAMPLE.COM Registry Domain ID: 2336799_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.markmonitor.com Registrar URL: http://www.markmonitor.com Updated Date: 2021-03-11T22:21:45Z Creation Date: 1993-11-05T05:00:00Z Registry Expiry Date: 2022-11-04T05:00:00Z Registrar: MarkMonitor Inc. Registrar IANA ID: 292 Registrar Abuse Contact Email: abusecomplaints@markmonitor.com Registrar Abuse Contact Phone: +1.2083895740 Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited Name Server: NS1.MARKMONITOR.COM Name Server: NS2.MARKMONITOR.COM Name Server: NS3.MARKMONITOR.COM Name Server: NS4.MARKMONITOR.COM Name Server: NS5.MARKMONITOR.COM Name Server: NS6.MARKMONITOR.COM Name Server: NS7.MARKMONITOR.COM DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/

Use case 2: Get information about an IP address

whois 8.8.8.8

Motivation: If you need to obtain information about an IP address, such as the allocation details, organization name, and contact information, you can use the ‘whois’ command. This can be helpful for investigating potential network issues, identifying malicious IP addresses, or verifying if an IP address is legitimate.

‘whois’ is the command-line client for the WHOIS protocol.
‘8.8.8.8’ is the IP address for which you want to retrieve information.

NetRange: 8.0.0.0 - 8.255.255.255 CIDR: 8.0.0.0/8 NetName: LVLT-GOGL-8-8-8 NetHandle: NET-8-0-0-0-1 Parent: NET8 (NET-8-0-0-0-0) NetType: Direct Allocation Organization: Level 3 Parent, LLC (LPL-141) RegDate: 1992-12-01 Updated: 2018-12-19 Ref: https://rdap.arin.net/registry/ip/8.0.0.0 OrgName: Level 3 Parent, LLC OrgId: LPL-141 Address: 100 CenturyLink Drive City: Monroe StateProv: LA PostalCode: 71203 Country: US RegDate: 2018-02-27 Updated: 2018-12-17 Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE Ref: https://rdap.arin.net/registry/entity/LPL-141

Use case 3: Get abuse contact for an IP address

whois -b 8.8.8.8

Motivation: If you come across suspicious or abusive behavior originating from an IP address, you may want to report it to the appropriate authorities or contacts. The ‘whois’ command with the ‘-b’ option allows you to quickly retrieve the abuse contact information for an IP address, enabling you to report any malicious activities.

‘whois’ is the command-line client for the WHOIS protocol.
‘-b’ is an option that specifies the abuse contact for the given IP address.
‘8.8.8.8’ is the IP address for which you want to retrieve abuse contact information.

OrgAbuseName: Abuse OrgAbusePhone: +1-877-453-8353 OrgAbuseEmail: abuse@level3.com

Conclusion:

The ‘whois’ command is a powerful tool for retrieving information about domain names and IP addresses. Whether you need to investigate domain ownership, troubleshoot network issues, or report abusive behavior, the ‘whois’ command provides easy access to the registered details associated with a domain or IP address.