Whois
Whois is a unix command that allows you to determine the ownership of a domain name.
Contents
Lesson
Intro to Whois
It is possible to perform a whois by typing:
| Terminal |
| localhost:~ $ whois google.com |
It will return a ton of data, sometimes personal information too.
- Whois is a bit more powerful than most people realize, most whois servers actually support fuzzy completion i.e: *.
Picking a Server
In order to get this fuzzy completion to work, you're going to want to tell your whois client to talk directly to a whois server. So let's use ARIN's whois server, whois.arin.net. To tell your whois client to use it, use: whois -h whois.arin.net Anything after that, will be the query for whois.arin.net to process. I recommend using quotes around whatever you're searching for, otherwise you might not get the results you expected.
So for your most basic query, do something like: whois -h whois.arin.net "4.2.2.1"
[Querying whois.arin.net] [whois.arin.net] # # Query terms are ambiguous. The query is assumed to be: # "n 4.2.2.1" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=4.2.2.1?showDetails=true&showARIN=true # NetRange: 4.0.0.0 - 4.255.255.255 CIDR: 4.0.0.0/8 OriginAS: NetName: LVLT-ORG-4-8 NetHandle: NET-4-0-0-0-1 Parent: NetType: Direct Allocation RegDate: 1992-12-01 Updated: 2009-06-19 Ref: http://whois.arin.net/rest/net/NET-4-0-0-0-1 OrgName: Level 3 Communications, Inc. OrgId: LVLT Address: 1025 Eldorado Blvd. City: Broomfield StateProv: CO PostalCode: 80021 Country: US RegDate: 1998-05-22 Updated: 2011-08-03 Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE Ref: http://whois.arin.net/rest/org/LVLT OrgTechHandle: TPL1-ARIN OrgTechName: Tech POC LVLT OrgTechPhone: +1-877-453-8353 OrgTechEmail: [email protected] OrgTechRef: http://whois.arin.net/rest/poc/TPL1-ARIN OrgAbuseHandle: APL8-ARIN OrgAbuseName: Abuse POC LVLT OrgAbusePhone: +1-877-453-8353 OrgAbuseEmail: [email protected] OrgAbuseRef: http://whois.arin.net/rest/poc/APL8-ARIN OrgTechHandle: ARINC4-ARIN OrgTechName: ARIN Contact OrgTechPhone: +1-800-436-8489 OrgTechEmail: [email protected] OrgTechRef: http://whois.arin.net/rest/poc/ARINC4-ARIN # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html #
As you can see above, it gives you some useful info like the size of the network that IP is in (useful for scans), also ARIN and all other registries keep unique identification on who owns blocks so you can use their TechHandle (above, ARINC4-ARIN) or AbuseHandle (above, APL8-ARIN) to look up their other IP blocks.
Getting the information that you want
If you haven't noticed, you can send pretty much anything to the whois server. Go ahead and try: whois -h whois.arin.net "?". As you can see, it gives you some help messages that describe how to perform more advanced queries.
Here is an example of part of the output:
Query-by-record-type: To limit your query to a specific record type, include one of the following flags: n Network address space r CIDRized network space d Delegations a Autonomous systems p Points-of-contact o Organizations c End-user customers e Points-of-contact, organizations, end-user customers z All of the above
As you can see, you can limit (or "unlimit") the type of record you are searching for. When building an advanced query, this is the first thing you'll put, I usually use 'z', for "all of the above."
So far we have: whois -h whois.arin.net "z", not too exciting. Next thing we can filter by is record attribute:
Query-by-attribute: To limit your query to a specific record attribute, include one of the following flags: @<domain name> Searches for matches by domain-portion of an email address !<handle> Searches for matches by handle or id /<name> Searches for matches by name .<name> Searches for matches by name (Same as above, but some whois clients have problems with.)
This allows you to filter whois results by attribute type. So for example, if you want to search for POC's by email domain only, you can use 'p @ <domain>'
So lets say you want to look up every point of contact that had google.com in the email address attrbgute: whois -h whois.arin.net "p @ google.com"
[Querying whois.arin.net] [whois.arin.net] # # The following results may also be obtained via: # http://whois.arin.net/rest/pocs;domain=google.com?showDetails=true # ABUSE2410-ARIN (ABUSE2410-ARIN) [email protected] +1-650-318-0200 ABUSE2410-ARIN (NETWO80-ARIN) [email protected] +1-650-318-0200 AdMob Network Operations (ANO60-ARIN) [email protected] +1-650-253-0000 AXELROD, Michael (MAX1-ARIN) [email protected] +1-650-253-0000 Barkan, Ari (ABA104-ARIN) [email protected] +1-310-468-1622 Barkan, Ari (ABA105-ARIN) [email protected] +1-310-460-4012 Chittimaneni, Kiran Kumar (KKC9-ARIN) [email protected] +1-650-253-3000 Fong, Zhen Elizabeth (ZEF-ARIN) [email protected] +1-626-243-3341 GC Abuse (GCABU-ARIN) [email protected] +1-650-253-0000 Google Apps (GOOGL-ARIN) [email protected] +1-650-253-0000 Google Inc (ZG39-ARIN) [email protected] +1-650-253-0000 Google Numbers Administration (GNA34-ARIN) [email protected] +1-650-253-0000 Higgin, Shawn Sr. NetEng (SHI68-ARIN) [email protected] +1-408-728-6140 Katenin, Gleb (KATEN-ARIN) [email protected] +353 (1) 543-2163 kwon, david (DKW2-ARIN) [email protected] +1-650-253-1322 LAPERRIERE, SYLVIE (SLA183-ARIN) [email protected] +1-514-670-8739 NETWORK ADMIN (NETWO4063-ARIN) [email protected] +1-320-629-8001 Network Administration (NETWO2832-ARIN) [email protected] +1-650-486-8100 Network Administration (NETWO81-ARIN) [email protected] +1-650-318-0200 Network Engineering (NETWO2831-ARIN) [email protected] +1-650-486-8100 Network Engineering Corp (NEC10-ARIN) [email protected] +1-650-214-6513 Ng, Tony (TNG31-ARIN) [email protected] +1-650-253-2576 Simmon, Matt (MSI136-ARIN) [email protected] +1-734-332-6874 Socolow, Paul (PSO26-ARIN) [email protected] +1-310-468-1622 Weaver, Tracy (TWE97-ARIN) [email protected] +1-734-276-4794 # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html #
Domain Whois Example
Example whois of a domain:
$ whois blackhatacademy.org NOTICE: Access to .ORG WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Public Interest Registry registry database. The data in this record is provided by Public Interest Registry for informational purposes only, and Public Interest Registry does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator or any ICANN-Accredited Registrar, except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Public Interest Registry reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. Domain ID:D162985960-LROR Domain Name:BLACKHATACADEMY.ORG Created On:08-Aug-2011 05:45:24 UTC Last Updated On:30-Aug-2011 07:44:03 UTC Expiration Date:08-Aug-2012 05:45:24 UTC Sponsoring Registrar:Active Registrar, Inc. (R1709-LROR) Status:TRANSFER PROHIBITED Registrant ID:ACTR1108301286 Registrant Name:Whois Manager Registrant Organization:Whois Proof LLP Registrant Street1:PO Box 4120 Registrant Street2: Registrant Street3: Registrant City:Portland Registrant State/Province:OR Registrant Postal Code:97208-4120 Registrant Country:US Registrant Phone:+1.2024700599 Registrant Phone Ext.: Registrant FAX:+1.8663666681 Registrant FAX Ext.: Registrant Email:[email protected] Admin ID:ACTR1108306123 Admin Name:Whois Manager Admin Organization:Whois Proof LLP Admin Street1:PO Box 4120 Admin Street2: Admin Street3: Admin City:Portland Admin State/Province:OR Admin Postal Code:97208-4120 Admin Country:US Admin Phone:+1.2024700599 Admin Phone Ext.: Admin FAX:+1.8663666681 Admin FAX Ext.: Admin Email:[email protected] Tech ID:ACTR1108307067 Tech Name:Whois Manager Tech Organization:Whois Proof LLP Tech Street1:PO Box 4120 Tech Street2: Tech Street3: Tech City:Portland Tech State/Province:OR Tech Postal Code:97208-4120 Tech Country:US Tech Phone:+1.2024700599 Tech Phone Ext.: Tech FAX:+1.8663666681 Tech FAX Ext.: Tech Email:[email protected] Name Server:VERA.NS.CLOUDFLARE.COM Name Server:ED.NS.CLOUDFLARE.COM DNSSEC:Unsigned
