Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

WHOIS

Default Port: 43

WHOIS is a query and response protocol for retrieving registration data about domain names, IP address blocks, and autonomous system numbers. The traditional protocol uses TCP port 43.

For generic top-level domains, RDAP replaced WHOIS as the definitive registration-data source on January 28, 2025. Port 43 WHOIS remains useful for Internet number resources and services that still publish it.

Public results may include:

  • Registrant details when they are published
  • Registrar and authoritative name servers
  • Creation, update, and registry expiry dates
  • Domain status and DNSSEC information
  • IP network and ASN assignments

Recon​

Domain Registration Data​

Query the available WHOIS service for a domain:

whois hackviser.com

WHOIS output varies by registry and registrar. Personal fields may be absent or marked as redacted, so do not assume that every result contains owner names or addresses.

IP Address and ASN Data​

WHOIS can also identify the organization and network range associated with an IP address or ASN:

whois <ip-address>
whois AS<number>

Enumeration​

Python's python-whois package can parse domain WHOIS responses, but returned fields depend on the registry response:

import whois

w = whois.whois('hackviser.com')
print(w)

print(w.status)
print(w.name)
print(w.org)
print(w.address)

Attack Vectors​

WHOIS and RDAP are reconnaissance sources rather than direct exploitation interfaces. Their public records can still expose operational details that support later assessment steps.

Information Leakage​

Registration data may reveal nameservers, registrar relationships, domain status, contact channels, related network ranges, and historical operational details. Privacy rules and proxy services often redact personal data.

whois example.com

Registration Lifecycle Monitoring​

An expiry date does not mean a domain is immediately available for registration. Depending on the registry and registrar, an expired domain may pass through auto-renew grace, redemption, and pending-delete states before it can be registered again. Monitor both the date and status fields:

whois example.com | grep -Ei "expiry|expiration|status"