View source for Whois

Whois is a unix command that allows you to determine the ownership of a domain name. 

==Lesson==
===Intro to Whois===
It is possible to perform a whois by typing: 

{{linuxCMD|whois google.com}}

It will return a ton of data, sometimes personal information too. 

* Whois is a bit more powerful than most people realize, most whois servers actually support fuzzy completion i.e: *.

===Picking a Server===
In order to get this fuzzy completion to work, you're going to want to tell your whois client to talk directly to a whois server. So let's use ARIN's whois server, whois.arin.net. To tell your whois client to use it, use: whois -h whois.arin.net
Anything after that, will be the query for whois.arin.net to process. I recommend using quotes around whatever you're searching for, otherwise you might not get the results you expected.

So for your most basic query, do something like: whois -h whois.arin.net "4.2.2.1"
<pre>
[Querying whois.arin.net]
[whois.arin.net]
#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 4.2.2.1"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=4.2.2.1?showDetails=true&showARIN=true
#

NetRange:       4.0.0.0 - 4.255.255.255
CIDR:           4.0.0.0/8
OriginAS:       
NetName:        LVLT-ORG-4-8
NetHandle:      NET-4-0-0-0-1
Parent:         
NetType:        Direct Allocation
RegDate:        1992-12-01
Updated:        2009-06-19
Ref:            http://whois.arin.net/rest/net/NET-4-0-0-0-1

OrgName:        Level 3 Communications, Inc.
OrgId:          LVLT
Address:        1025 Eldorado Blvd.
City:           Broomfield
StateProv:      CO
PostalCode:     80021
Country:        US
RegDate:        1998-05-22
Updated:        2011-08-03
Comment:        ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
Ref:            http://whois.arin.net/rest/org/LVLT

OrgTechHandle: TPL1-ARIN
OrgTechName:   Tech POC LVLT
OrgTechPhone:  +1-877-453-8353 
OrgTechEmail:  ipaddressing@level3.com
OrgTechRef:    http://whois.arin.net/rest/poc/TPL1-ARIN

OrgAbuseHandle: APL8-ARIN
OrgAbuseName:   Abuse POC LVLT
OrgAbusePhone:  +1-877-453-8353 
OrgAbuseEmail:  security@level3.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/APL8-ARIN

OrgTechHandle: ARINC4-ARIN
OrgTechName:   ARIN Contact
OrgTechPhone:  +1-800-436-8489 
OrgTechEmail:  arin-contact@genuity.net
OrgTechRef:    http://whois.arin.net/rest/poc/ARINC4-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
</pre>

As you can see above, it gives you some useful info like the size of the network that IP is in (useful for scans), also ARIN and all other registries keep unique identification on who owns blocks so you can use their TechHandle (above, ARINC4-ARIN) or AbuseHandle (above, APL8-ARIN) to look up their other IP blocks.

===Getting the information that you want===
If you haven't noticed, you can send pretty much anything to the whois server. Go ahead and try: whois -h whois.arin.net "?". As you can see, it gives you some help messages that describe how to perform more advanced queries.

Here is an example of part of the output:
<pre>
Query-by-record-type:
To limit your query to a specific record type, include one of the following flags:
n	Network address space
r	CIDRized network space
d	Delegations
a	Autonomous systems
p	Points-of-contact
o	Organizations
c	End-user customers
e	Points-of-contact, organizations, end-user customers
z	All of the above
</pre>

As you can see, you can limit (or "unlimit") the type of record you are searching for. When building an advanced query, this is the first thing you'll put, I usually use 'z', for "all of the above."

So far we have: whois -h whois.arin.net "z", not too exciting. Next thing we can filter by is record attribute:

<pre>
Query-by-attribute:
To limit your query to a specific record attribute, include one of the following flags: 
@<domain name>	Searches for matches by domain-portion of an email address
!<handle> 		Searches for matches by handle or id
/<name>			Searches for matches by name
.<name>			Searches for matches by name (Same as above, but some whois clients have problems with.)
</pre>

This allows you to filter whois results by attribute type. So for example, if you want to search for POC's by email domain only, you can use 'p @ <domain>'

So lets say you want to look up every point of contact that had google.com in the email address attrbgute: whois -h whois.arin.net "p @ google.com"

<pre>
[Querying whois.arin.net]
[whois.arin.net]
#
# The following results may also be obtained via:
# http://whois.arin.net/rest/pocs;domain=google.com?showDetails=true
#

ABUSE2410-ARIN (ABUSE2410-ARIN) postini-arin-abuse@google.com +1-650-318-0200
ABUSE2410-ARIN (NETWO80-ARIN) postini-arin-contact@google.com +1-650-318-0200
AdMob Network Operations (ANO60-ARIN) admob-netops@google.com +1-650-253-0000
AXELROD, Michael  (MAX1-ARIN) axelrod@google.com +1-650-253-0000
Barkan, Ari  (ABA104-ARIN) ari@google.com +1-310-468-1622
Barkan, Ari  (ABA105-ARIN) ari@google.com +1-310-460-4012
Chittimaneni, Kiran Kumar (KKC9-ARIN) kk@google.com +1-650-253-3000
Fong, Zhen Elizabeth (ZEF-ARIN) elizabeth@ugcs.caltech.edu +1-626-243-3341
GC Abuse (GCABU-ARIN) gc-abuse@google.com +1-650-253-0000
Google Apps (GOOGL-ARIN) apps-arin-contact@google.com +1-650-253-0000
Google Inc (ZG39-ARIN) arin-contact@google.com +1-650-253-0000
Google Numbers Administration (GNA34-ARIN) arin-contact@google.com +1-650-253-0000
Higgin, Shawn Sr. NetEng  (SHI68-ARIN) shiggin@google.com +1-408-728-6140
Katenin, Gleb  (KATEN-ARIN) gleb@google.com +353 (1) 543-2163
kwon, david  (DKW2-ARIN) dkwon@google.com +1-650-253-1322
LAPERRIERE, SYLVIE  (SLA183-ARIN) slaperriere@google.com +1-514-670-8739
NETWORK ADMIN (NETWO4063-ARIN) crack.engine@google.com +1-320-629-8001
Network Administration (NETWO2832-ARIN) inoc@google.com +1-650-486-8100
Network Administration (NETWO81-ARIN) postini-arin-contact@google.com +1-650-318-0200
Network Engineering (NETWO2831-ARIN) postini-neteng@google.com +1-650-486-8100
Network Engineering Corp (NEC10-ARIN) ir-contact-netops-corp@google.com +1-650-214-6513
Ng, Tony  (TNG31-ARIN) tng@google.com +1-650-253-2576
Simmon, Matt  (MSI136-ARIN) mpsimmon@google.com +1-734-332-6874
Socolow, Paul  (PSO26-ARIN) socolow@google.com +1-310-468-1622
Weaver, Tracy  (TWE97-ARIN) tracyweaver@google.com +1-734-276-4794


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
</pre>

===Domain Whois Example===

Example whois of a domain:
<pre>
$ whois blackhatacademy.org

  NOTICE: Access to .ORG WHOIS information is provided to assist persons in 
  determining the contents of a domain name registration record in the Public Interest Registry
  registry database. The data in this record is provided by Public Interest Registry
  for informational purposes only, and Public Interest Registry does not guarantee its 
  accuracy.  This service is intended only for query-based access.  You agree 
  that you will use this data only for lawful purposes and that, under no 
  circumstances will you use this data to: (a) allow, enable, or otherwise 
  support the transmission by e-mail, telephone, or facsimile of mass 
  unsolicited, commercial advertising or solicitations to entities other than 
  the data recipient's own existing customers; or (b) enable high volume, 
  automated, electronic processes that send queries or data to the systems of 
  Registry Operator or any ICANN-Accredited Registrar, except as reasonably 
  necessary to register domain names or modify existing registrations.  All 
  rights reserved. Public Interest Registry reserves the right to modify these terms at any 
  time. By submitting this query, you agree to abide by this policy. 

  Domain ID:D162985960-LROR
  Domain Name:BLACKHATACADEMY.ORG
  Created On:08-Aug-2011 05:45:24 UTC
  Last Updated On:30-Aug-2011 07:44:03 UTC
  Expiration Date:08-Aug-2012 05:45:24 UTC
  Sponsoring Registrar:Active Registrar, Inc. (R1709-LROR)
  Status:TRANSFER PROHIBITED

  Registrant ID:ACTR1108301286
  Registrant Name:Whois Manager
  Registrant Organization:Whois Proof LLP
  Registrant Street1:PO Box 4120
  Registrant Street2:
  Registrant Street3:
  Registrant City:Portland
  Registrant State/Province:OR
  Registrant Postal Code:97208-4120
  Registrant Country:US
  Registrant Phone:+1.2024700599
  Registrant Phone Ext.:
  Registrant FAX:+1.8663666681
  Registrant FAX Ext.:
  Registrant Email:mcm158w2@whoisproof.com

  Admin ID:ACTR1108306123
  Admin Name:Whois Manager
  Admin Organization:Whois Proof LLP
  Admin Street1:PO Box 4120
  Admin Street2:
  Admin Street3:
  Admin City:Portland
  Admin State/Province:OR
  Admin Postal Code:97208-4120
  Admin Country:US
  Admin Phone:+1.2024700599
  Admin Phone Ext.:
  Admin FAX:+1.8663666681
  Admin FAX Ext.:
  Admin Email:mcm158w2@whoisproof.com

  Tech ID:ACTR1108307067
  Tech Name:Whois Manager
  Tech Organization:Whois Proof LLP
  Tech Street1:PO Box 4120
  Tech Street2:
  Tech Street3:
  Tech City:Portland
  Tech State/Province:OR
  Tech Postal Code:97208-4120
  Tech Country:US
  Tech Phone:+1.2024700599
  Tech Phone Ext.:
  Tech FAX:+1.8663666681
  Tech FAX Ext.:
  Tech Email:mcm158w2@whoisproof.com

  Name Server:VERA.NS.CLOUDFLARE.COM
  Name Server:ED.NS.CLOUDFLARE.COM

  DNSSEC:Unsigned

</pre>