Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

whois — domain and IP data

4 min whois

Shows a domain's or IP's owner and abuse contact; for domains, some fields are hidden by the registrar's privacy shield.

Cheat sheet

5 commands Printable version
  • whois example.com a domain (registrar, expiry, NS)
  • whois 1.2.3.4 an IP (network, provider, abuse)
  • whois IP | grep -i abuse the abuse contact
  • whois IP | grep -iE 'cidr|netrange' the network block (for banning)
  • whois -h whois.ripe.net IP a specific registry
  • dig — what IP a domain has ; whois — who owns that IP/domain

Overview

whois queries registration data for a domain or IP: owner, registrar, dates, network range, abuse contacts. Useful when investigating suspicious traffic, checking a domain, or finding who to complain to about an attack.

bash 
whois example.com                 # domain data
whois 8.8.8.8                     # whose network / provider / abuse contact

Not installed? sudo apt install whois.

Options

1

A top-level whois server often just forwards to a regional registry (RIPE, ARIN, APNIC) — -h queries the right server directly if the general answer is truncated or incomplete. IP data is usually more complete than domain data: domains have some fields hidden by the registrar's privacy protection (GDPR).

Option What it does Example
-h server Query a specific whois server instead of the default one. whois -h whois.ripe.net 1.2.3.4

Nothing found. Try a shorter query.

Recipes

2

Common tasks

bash 
# a domain's expiry, registrar, name servers:
whois example.com | grep -iE 'expir|registrar|name server|status'

# whose network an IP belongs to, and who to complain to:
whois 1.2.3.4 | grep -iE 'orgname|netname|country|abuse|cidr|netrange'

# the provider's whole network block (for a firewall ban):
whois 1.2.3.4 | grep -iE 'cidr|route'

# ask a specific regional registry:
whois -h whois.ripe.net 1.2.3.4   # RIPE (Europe)
whois -h whois.arin.net 1.2.3.4   # ARIN (North America)

Paired with DNS: dig tells you which IP a domain has; whois tells you who owns that IP/domain.

Investigating an attack

A typical path for "where is this coming from" (combined with fail2ban/journalctl logs):

bash 
ss -tnp | grep :22                # current suspicious connections → an IP
whois 1.2.3.4 | grep -iE 'netrange|cidr|abuse'   # whose block, and who to complain to
# ban the provider's whole block (CIDR) in the firewall:
sudo nft add rule inet filter input ip saddr 1.2.3.0/24 drop   # see firewall

Troubleshooting

4

Empty/sparse answer for a domain

The data is hidden by privacy protection (GDPR/WHOIS privacy). Some fields are only visible to the registrar. For an IP, the data is usually more complete than for domains.

The answer is "truncated" or redirects to another server

The top-level whois server points to the registrar/registry. Query the right server directly with -h (RIPE/ARIN/APNIC, by the IP's region).

Want to trace an attack and block the network

whois 1.2.3.4 → abuse/OrgAbuseEmail (a complaint), NetRange/CIDR (the whole block, for blocking in firewall).

whois is slow/times out

The registry rate-limits queries. Don't hammer it in a loop; cache the result.

See also

  • dns-resolv — How a name becomes an IP — resolv.conf, systemd-resolved, /etc/hosts, dig.
  • network-diagnostics — A connectivity checklist — from the gateway to DNS and the destination port.

Found an inaccuracy? Report an error in the article

Topics
Loading…