R-WHO
whois
Look up domain and IP registration records during passive recon.
OVERVIEW
whois is the classic registration lookup client — on Debian/Kali it is Marco d’Itri’s whois (github.com/rfc1036/whois). You pass a domain or an IP and it queries the matching registry (Verisign, RIPE, ARIN, and the rest) for registrar, nameservers, creation dates, and the netblock’s org. That is passive recon: no packet to the target’s own infrastructure.
GDPR-era redaction means abuse/admin contacts are often empty; nameservers, registrar, and the CIDR/org for an IP still land. Follow nameservers with dig, and treat a neighbouring IP in the same netblock as out of scope until the client confirms ownership. Some operators now prefer RDAP; whois remains the tool that is already on the box.
USE CASES
Practical use cases
- 01
Pulling registrar and nameserver data for a scoped domain before DNS enum.
- 02
Mapping an IP to a netblock and organisation to see who owns the range.
- 03
Noting creation and expiry dates as context for a takeover or lapse discussion.
- 04
Comparing several related domains to see whether they share a registrar or NS set.
QUICK START
When scope starts from a domain or IP and you need registrar, nameserver, and netblock ownership before any active scan.
- Confirm OSINT against the domain or IP is in the authorized recon scope.
- Query the domain first, then any IP you already resolved.
- Record registrar, NS, and org/netblock; ignore empty privacy-redacted contacts.
- Do not scan neighbouring IPs in the same CIDR until ownership is confirmed.
whois target.exampleBEFORE YOU RUN IT
What to check before running it
A netblock org is not the same as the client — cloud and ISP ranges need an ownership check before any scan.
whois servers rate-limit; a tight loop across a large domain list can get you blocked and still counts as recon traffic to third parties.
Privacy redaction is normal; missing abuse contacts are not a finding on their own.