whois
Networking
Usage
whois <domain|ip>Looks up the registration record of a domain or IP block; personal fields are mostly redacted now and every TLD server formats its reply its own way, so parsing that output in a script breaks easily.
Common flags
| Flag | Meaning |
|---|---|
| <domain> | Registrar, dates and name servers, if the TLD server publishes them. |
| <ip> | Which organisation owns the address block, and its abuse contact. |
| -h <server> | Query one specific whois server. |
| -H | Hide the legal boilerplate that fills most replies. |
Examples
whois example.com | grep -i expirWhen the domain expires.
whois 1.1.1.1Who owns the address that is hitting your logs.
When a connection fails, these narrow down how far it got — name not resolving, no route, or a blocked port.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does whois do?
Looks up the registration record of a domain or IP block; personal fields are mostly redacted now and every TLD server formats its reply its own way, so parsing that output in a script breaks easily.
Q. How do I type it?
whois <domain|ip> — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
4 are listed here; the full set is in man whois. This command sits under Networking.
Related commands
man page: man whois