Skip to main content

WHOIS

WHOIS allows us to look retrieve information on an already registered domain. Think of it as a searchable list of all domains currently registered worldwide. It uses TCP port 43 by default. This protocol is defined in RFC 3912.

The Internet Corporation of Assigned Names and Numbers (ICANN) requires that accredited registrars enter the holder's contact information, domain creation, expiration dates, and other information into the Whois database immediately after registering a domain.

On Windows, we can use Sysinternals WHOIS or WHOIS in Linux. It is usually done in the command line. There are some web applications that provides a GUI for this.

To use whois, we can simply use the following command:

whois mydomain-here.lan

Command breakdown:

  • mydomain-here.lan - The domain name of the target.

An example will be:

whois google.com

The results are:

whois1.png

We can see from the above screenshot of some of the information provided.