Domain registration and IP address lookup service for querying WHOIS databases for ownership and metadata.
whois {host-host} {port-port} {verbose} {no-recursion} {help} 🌍 host-host → ip 🌍 port-port → port 📎 verbose 📎 no-recursion 📎 help whois {host-host} {port-port} {verbose} {no-recursion} {help}Sandbox: execFile · Timeout: 30s
security.intel.whois security.intel.domain security.intel.ip security.recon.passive network.dns.lookup | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
host HOST | string | No | - | connect to server HOST | -h, --host HOST |
port PORT | integer | No | - | connect to PORT | -p, --port PORT |
verbose | string | No | - | explain what is being done | --verbose |
no-recursion | string | No | - | disable recursion from registry to registrar servers | --no-recursion |
help | string | No | - | display this help and exit | --help |
version | string | No | - | output version information and exit | --version |
flag-l | string | No | - | find the one level less specific match | -l |
flag-m | string | No | - | find all one level more specific matches | -m |
flag-c | string | No | - | find the smallest match containing a mnt-irt attribute | -c |
flag-x | string | No | - | exact match | -x |
flag-b | string | No | - | return brief IP address ranges with abuse contact | -b |
flag-d | string | No | - | return DNS reverse delegation objects too | -d |
flag-i | string | No | - | do an inverse look-up for specified ATTRibutes | -i |
flag-T | string | No | - | only look for objects of TYPE | -T |
flag-r | string | No | - | turn off recursive look-ups for contact information | -r |
flag-a | string | No | - | also search all the mirrored databases | -a |
flag-s | string | No | - | Set the flag-s parameter | -s |
flag-g | string | No | - | find updates from SOURCE from serial FIRST to LAST | -g, -L |
flag-t | string | No | - | request template for object of TYPE | -t |
flag-v | string | No | - | request verbose template for object of TYPE | -v |
flag-q | string | No | - | Set the flag-q parameter | -q |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
security.intel.whois.record | WHOIS record data for domain or IP | text/plain | - | community |
Inputs
network.target.domain Domain name to query
network.target.ip IP address to query
Outputs
security.intel.whois.record Domain or IP registration details
network_traffic Produces
security.intel.whois.recordConsumes
network.target.domainnetwork.target.ip| Resource | Value |
|---|---|
| CPU | low |
| Memory | 8 MB |
| Network | low |
| Disk I/O | none |
Query domain registration information
whois example.comQuery IP address ownership
whois 8.8.8.8Query a specific WHOIS server
whois -h whois.verisign-grs.com example.comGet raw server response
whois -v example.comRetrieve registration details of an IP address
whois 192.0.2.1Query a specific WHOIS server for domain information
whois -h whois.nic.xyz example.xyzDisplay command usage information in case of errors or unsure use
whois -hUse specific WHOIS server on a non-standard port
whois -h whois.example.com -p 43 example.comFormat output to be more readable by human
whois -H example.comDisplay help and additional options
whois --helpWHOIS is a query and response protocol for querying databases that store registered users or assignees of domain names and IP address blocks. It's an essential tool for passive reconnaissance and domain research.
| Data Point | Description |
|---|---|
| Registrar | Company where domain was registered |
| Registrant | Domain owner name and organization |
| Creation Date | When the domain was registered |
| Expiration Date | When registration expires |
| Name Servers | DNS servers for the domain |
| Admin/Tech Contacts | Administrative and technical contacts |