How to Get Domain and IP Address Information Using WHOIS Command?

The WHOIS command is a widely-used protocol for retrieving registration information about domain names and IP addresses. Originally intended for system administrators and network engineers to diagnose network issues, it has now become a popular tool for anyone looking to gather information on a domain or IP address. When you initiate a WHOIS query, your computer sends a request to a WHOIS server - a database of registered domain names and IP addresses. In response, the server provides registration information for the requested domain or IP address.

The data obtained by the WHOIS command can include the name and contact details of the domain or IP address owner and also details of the registration date, and the expiration date. It can also give technical information about the domain, such as its name servers and associated DNS records.

The Internet Corporation for Assigned Names and Numbers (ICANN) governs the WHOIS protocol, managing domain name systems and IP address allocation. The information made available through the WHOIS protocol is considered public information and can be accessed by anyone.

Here are some steps involved in using the WHOIS command −

Step 1 − Open the Command Prompt or Terminal in your system

The command prompt or terminal window is where you will enter the WHOIS command to retrieve domain name and IP address information. On Windows, press Windows key + R, type "cmd" in the Run dialog box and press Enter. On a Mac, open Terminal from the Launchpad by searching for "Terminal" in the search bar. Note that the exact steps may vary depending on your operating system and version, but you can search the internet for specific instructions.

Step 2 − Enter the WHOIS Command to find the domain name and IP address

After opening the command prompt or terminal window in Step 1, now next step is to enter the WHOIS command to get the domain name and IP address information that we need.

The syntax for the WHOIS command −

whois <domain name>

The WHOIS command directs your computer to establish a connection with the WHOIS database and fetch relevant details about the provided domain name or IP address.

To illustrate, suppose you wish to get information regarding the domain "tutotialpoint.com", then you would input the following command in prompt or terminal −

whois tutotialpoint.com

After executing the command, the output could appear like this −

Domain Name: TUTORIALPOINT.COM
Registry Domain ID: 233634230_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2022-08-15T19:27:37Z
Creation Date: 2005-10-06T19:39:45Z
Registry Expiry Date: 2027-10-06T19:39:45Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: 480-624-2505
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Name Server: NS-1148.AWSDNS-15.ORG
Name Server: NS-1918.AWSDNS-47.CO.UK
Name Server: NS-21.AWSDNS-02.COM
Name Server: NS-771.AWSDNS-32.NET
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2023-03-12T08:08:06Z <<<

By examining the output displayed earlier, it is clear that "tutorialpoint.com" is currently registered with GoDaddy.com, LLC. It was first registered on July 6, 2005, and the output also includes details about the domain's expiration date and contact information for the registrar.

If you want to fetch details about an IP address using the WHOIS command, you can enter the following command in the Linux terminal −

whois <ip address>

Now we can write IP address after the “whois” keyword.

whois 93.184.216.34

Below is a sample output that you may see when you execute the command −

NetRange:       93.184.0.0 - 93.185.255.255
CIDR:           93.184.0.0/15
NetName:        AKAMAI
NetHandle:      NET-93-184-0-0-1
Parent:         NET93 (NET-93-0-0-0-0)
NetType:        Direct Allocation
OriginAS:
Organization:   Akamai Technologies, Inc. (AKAMAI)
RegDate:        2008-05-30
Updated:        2019-07-31
Ref:            https://rdap.arin.net/registry/ip/93.184.0.0
OrgName:        Akamai Technologies, Inc.
OrgId:          AKAMAI
Address:        145 Broadway
City:           Cambridge
StateProv:      MA
PostalCode:     02142
Country:        US
RegDate:        1999-01-21
Updated:        2021-01-28
Ref:            https://rdap.arin.net/registry/entity/AKAMAI

The WHOIS command shows that 93.184.216.34 belongs to Akamai Technologies, Inc. and provides their contact information. This command is useful for network administrators and security professionals who need to identify IP address owners for troubleshooting and security purposes. WHOIS makes it easy to obtain essential details about an IP address's owner to take appropriate steps in resolving issues or investigating potential threats.

Step 3 −  Analyze the Output

Once the WHOIS command is entered, the command prompt or terminal window will display the corresponding output. The output will differ based on the domain name or IP address entered in the query. However, it generally contains crucial details, such as the domain's registrar, registration date, and contact information of the registrar.

As we have seen the command and output in step 2 now we can Analyze it.

Step 4 − Interpret the Output

Interpret the Output is an essential part of the data analysis process. This step involves carefully examining the results or output generated by a system or model to draw meaningful conclusions.

During the interpretation process, we need to examine the data and results closely while also being aware of any limitations or assumptions made during the analysis. This helps you to draw accurate and meaningful inferences or conclusions from the findings.

To interpret the output, we may use various techniques such as visualizations, statistical analysis, or qualitative analysis, depending on the nature of the data and the research question being investigated. It's important for me to synthesize information from multiple sources and consider different perspectives and potential biases while assessing the validity and reliability of the results.

Overall, we know that interpreting the output is a critical step in the data analysis process that enables me to make informed decisions and draw meaningful insights from the data.

Conclusion

In conclusion, the WHOIS command is a vital tool for obtaining important data about IP addresses and domain names. This function gives you access to a sizable database of domain names and IP addresses that have been registered, allowing you to get details about ownership, registration date, and contact information that can be used for a variety of tasks like research, security, and reporting. Anyone, who is interested in finding out more about a domain name or IP address should use the WHOIS command because it is simple to use and fetch information. Users receive reliable and current information from it making it a valuable tool for a variety of jobs. We trust that this post has given you helpful insights on how to use Linux's WHOIS command to gather all the information you require.