What is WHOIS?

WHOIS is an acronym. It stands for “Who Is.” The name reflects the purpose of the protocol, which is to provide information about the registrants or assignees of internet resources, such as domain names and IP addresses. This system allows users to query and retrieve information about these resources, identifying the individuals or organizations associated with them. This protocol is also loosely referred to as “reverse WHOIS”.

How it works:

1. Query Initiation:
   • When you initiate a WHOIS query, you are essentially asking for information about a particular domain name, IP address, or autonomous system number (ASN).
   • Queries can be executed through command-line tools like whois in Unix-based systems or by using online services provided by various domain registrars or independent organizations.
2. WHOIS Database:
   • The information queried is stored in a centralized WHOIS database.
   • Different entities manage WHOIS databases for specific top-level domains (TLDs). For example, Verisign manages the .com and .net TLDs.
3. Domain Registrar:
   • Domain registrars are responsible for managing the registration of domain names on behalf of domain owners.
   • When someone registers a domain, the registrar collects information from the registrant and updates the WHOIS database with this information.
4. Information Retrieval:
   • When a query is made, the WHOIS server for the relevant TLD or IP address range is contacted.
   • The server then retrieves and returns information about the registered domain or IP address, including details such as the registrant’s name, organization, email address, registration and expiration dates, DNS server information, and more.
5. Privacy Protection Services:
   • Some domain registrars offer privacy protection services that allow domain owners to keep their personal information private in the public WHOIS database.
   • Instead of displaying the registrant’s personal details, the registrar’s information or a forwarding service may be shown.

It’s important to note that access to WHOIS data and the level of detail provided may vary depending on the TLD and the policies of the domain registrar. Additionally, privacy regulations and policies, such as GDPR, have influenced the availability and display of personal information in WHOIS databases.

How To Lookup WHOIS information about any domain:

1. ICANN WHOIS Website:
   • The ICANN (Internet Corporation for Assigned Names and Numbers) provides a web-based WHOIS lookup service on their official website.
   • Users can enter the domain name in the search bar on the website to retrieve information about the domain, including registration details.
2. Command-Line Interface (CLI) – Linux and Windows:
   • On Linux, the whois command is commonly used in the terminal. For example: whois example.com.
   • On Windows, you can use the nslookup command with the -type=ns option. For example: nslookup -type=ns example.com.
   • These commands query the WHOIS servers and display the registration information for the specified domain.
3. Python:
   • Python offers various libraries for interacting with WHOIS servers. One popular library is whois.
   • Install the library using: pip install python-whois.
   • Then, you can use the library in a Python script to perform WHOIS lookups programmatically.
     import whois
domain_info = whois.whois('example.com')
print(domain_info)
4. NodeJS:
   • In Node.js, you can use libraries like whois-json for WHOIS lookups.
   • Install the library using npm install whois-json.
   • Here’s a simple example using Node.js:
     const whois = require('whois-json');
whois('example.com', (err, data) => {
if (err) {
console.error(err);
} else {
console.log(data);
}
});

Food for thought: Try deploying this as a service to AWS Lambda!

These examples showcase how WHOIS information can be retrieved through various means, catering to different preferences and technical environments.