whois — Domain and IP registration lookup

Linux / Network and Firewall / whois.html

Looks up registrar, registrant, name servers and contacts for a domain or address block.

Basic Information

What is this command?

whois fetches registration data for domains and address blocks from registry servers.

It shows registrar, name servers, expiry dates and contacts, useful for domain administration.

What problems does it solve?

• Check the registrar and expiry date of a domain.
• See which name servers the domain is delegated to.
• Find the allocation owner of an address block.
• Trace the network owner behind suspicious traffic.

Key features

Domain lookup

Passing a domain name fetches its registration data.

• When to use: When checking ownership or expiry.
• What you get: Registrar, status, name servers and expiry are printed.
• Limitations: Privacy policies may redact some fields.

Address block lookup

Passing an IP address looks up the block that contains it.

• When to use: When identifying who operates a source network.
• What you get: The allocating registry and network name appear.
• Limitations: Contact details differ between registries.

Choose a server

You can query a specific whois server.

• When to use: When querying a national registry directly.
• What you get: The raw answer of that server is shown.
• Limitations: Query formats and limits vary by server.

Installation and usage

Check whether it is installed

whois -h whois.example.net example.com

sudo apt install whois

Real-world examples

Domain data

Fetch domain registration data.

whois example.com

Address block

Inspect the block that owns an address.

whois 203.0.113.10

Trim output

Keep only the fields of interest.

whois example.com | grep -Ei 'registrar|expiry|name server'